@aztec/pxe 0.0.1-commit.c31f2472 → 0.0.1-commit.c52d6e7

package/dest/contract_function_simulator/oracle/utility_execution_oracle.js

@@ -1,109 +1,189 @@
+import { PRIVATE_LOG_CIPHERTEXT_LEN } from '@aztec/constants';
+import { uniqueBy } from '@aztec/foundation/collection';
 import { Aes128 } from '@aztec/foundation/crypto/aes128';
 import { Fr } from '@aztec/foundation/curves/bn254';
-import { LogLevels, applyStringFormatting, createLogger } from '@aztec/foundation/log';
+import { Point } from '@aztec/foundation/curves/grumpkin';
+import { LogLevels, createLogger } from '@aztec/foundation/log';
+import { ExecutionError, extractCallStack, resolveAssertionMessageFromError, toACVMWitness, witnessMapToFields } from '@aztec/simulator/client';
+import { STANDARD_HANDSHAKE_REGISTRY_ADDRESS } from '@aztec/standard-contracts/handshake-registry/constants';
+import { FunctionSelector } from '@aztec/stdlib/abi';
 import { siloNullifier } from '@aztec/stdlib/hash';
-import { computeAddressSecret } from '@aztec/stdlib/keys';
-import { deriveEcdhSharedSecret } from '@aztec/stdlib/logs';
-import { getNonNullifiedL1ToL2MessageWitness } from '@aztec/stdlib/messaging';
+import { computeAddressSecret, hashPublicKey } from '@aztec/stdlib/keys';
+import { AppTaggingSecret, FlatPublicLogs, appSiloEcdhSharedSecret } from '@aztec/stdlib/logs';
+import { getL1ToL2MessageWitness } from '@aztec/stdlib/messaging';
 import { MerkleTreeId } from '@aztec/stdlib/trees';
+import { CallContext } from '@aztec/stdlib/tx';
+import { createContractLogger, logContractMessage, stripAztecnrLogPrefix } from '../../contract_logging.js';
 import { EventService } from '../../events/event_service.js';
 import { LogService } from '../../logs/log_service.js';
 import { NoteService } from '../../notes/note_service.js';
-import { ORACLE_VERSION } from '../../oracle_version.js';
-import { EventValidationRequest } from '../noir-structs/event_validation_request.js';
-import { LogRetrievalRequest } from '../noir-structs/log_retrieval_request.js';
-import { LogRetrievalResponse } from '../noir-structs/log_retrieval_response.js';
-import { NoteValidationRequest } from '../noir-structs/note_validation_request.js';
-import { UtilityContext } from '../noir-structs/utility_context.js';
+import { ORACLE_VERSION_MAJOR } from '../../oracle_version.js';
+import { assertAllowedScope } from '../../storage/allowed_scopes.js';
+import { FactCollectionKey, FactCollectionTypeKey, anchoredTipBlockNumbers } from '../../storage/fact_store/index.js';
+import { EphemeralArrayService } from '../ephemeral_array_service.js';
+import { BoundedVec } from '../noir-structs/bounded_vec.js';
+import { EphemeralArray } from '../noir-structs/ephemeral_array.js';
+import { emptyFactCollection, toNoirFactCollection } from '../noir-structs/fact_collection.js';
+import { Option } from '../noir-structs/option.js';
 import { pickNotes } from '../pick_notes.js';
-import { MessageLoadOracleInputs } from './message_load_oracle_inputs.js';
+import { buildACIRCallback } from './acir_callback.js';
 /**
  * The oracle for an execution of utility contract functions.
  */ export class UtilityExecutionOracle {
-    contractAddress;
+    isMisc = true;
+    isUtility = true;
+    contractLogger;
+    aztecnrLogger;
+    offchainEffects = [];
+    ephemeralArrayService = new EphemeralArrayService();
+    transientArrayService;
+    /** Keyed by tx hash string. */ txReceiptsCache = new Map();
+    /**
+   * Information that can be used to validate the existence of a note or an event, keyed by tx hash string. It is
+   * populated by the node queries that precede validation (tagged log retrieval, tx resolution), which already return
+   * everything validation needs, so validating a note or event created in one of those txs costs no node roundtrip.
+   * Notes and events reached through other paths (e.g. offchain inbox messages) still need a receipt.
+   */ validationTxDataCache = new Map();
+    // We store oracle version to be able to show a nice error message when an oracle handler is missing.
+    contractOracleVersion;
+    callContext;
     authWitnesses;
     capsules;
     anchorBlockHeader;
-    contractStore;
+    anchoredContractData;
     noteStore;
     keyStore;
     addressStore;
     aztecNode;
-    anchorBlockStore;
     recipientTaggingStore;
-    senderAddressBookStore;
-    capsuleStore;
+    taggingSecretSourcesStore;
+    capsuleService;
+    factService;
     privateEventStore;
+    txResolver;
+    contractSyncService;
+    l2TipsStore;
     jobId;
-    log;
+    logger;
     scopes;
-    isMisc;
-    isUtility;
-    aztecNrDebugLog;
-    constructor(contractAddress, /** List of transient auth witnesses to be used during this simulation */ authWitnesses, capsules, anchorBlockHeader, contractStore, noteStore, keyStore, addressStore, aztecNode, anchorBlockStore, recipientTaggingStore, senderAddressBookStore, capsuleStore, privateEventStore, jobId, log = createLogger('simulator:client_view_context'), scopes){
-        this.contractAddress = contractAddress;
-        this.authWitnesses = authWitnesses;
-        this.capsules = capsules;
-        this.anchorBlockHeader = anchorBlockHeader;
-        this.contractStore = contractStore;
-        this.noteStore = noteStore;
-        this.keyStore = keyStore;
-        this.addressStore = addressStore;
-        this.aztecNode = aztecNode;
-        this.anchorBlockStore = anchorBlockStore;
-        this.recipientTaggingStore = recipientTaggingStore;
-        this.senderAddressBookStore = senderAddressBookStore;
-        this.capsuleStore = capsuleStore;
-        this.privateEventStore = privateEventStore;
-        this.jobId = jobId;
-        this.log = log;
-        this.scopes = scopes;
-        this.isMisc = true;
-        this.isUtility = true;
-        this.aztecNrDebugLog = createLogger('aztec-nr:debug_log');
-    }
-    utilityAssertCompatibleOracleVersion(version) {
-        if (version !== ORACLE_VERSION) {
-            throw new Error(`Incompatible oracle version. Expected version ${ORACLE_VERSION}, got ${version}.`);
+    simulator;
+    hooks;
+    utilityExecutor;
+    constructor(args){
+        this.callContext = args.callContext;
+        this.authWitnesses = args.authWitnesses;
+        this.capsules = args.capsules;
+        this.anchorBlockHeader = args.anchorBlockHeader;
+        this.anchoredContractData = args.anchoredContractData;
+        this.noteStore = args.noteStore;
+        this.keyStore = args.keyStore;
+        this.addressStore = args.addressStore;
+        this.aztecNode = args.aztecNode;
+        this.recipientTaggingStore = args.recipientTaggingStore;
+        this.taggingSecretSourcesStore = args.taggingSecretSourcesStore;
+        this.capsuleService = args.capsuleService;
+        this.factService = args.factService;
+        this.privateEventStore = args.privateEventStore;
+        this.txResolver = args.txResolver;
+        this.contractSyncService = args.contractSyncService;
+        this.l2TipsStore = args.l2TipsStore;
+        this.jobId = args.jobId;
+        this.logger = args.log ?? createLogger('simulator:client_view_context');
+        this.scopes = args.scopes;
+        this.simulator = args.simulator;
+        this.hooks = args.hooks;
+        this.utilityExecutor = args.utilityExecutor;
+        this.transientArrayService = args.transientArrayService;
+    }
+    assertCompatibleOracleVersion(major, minor) {
+        if (major !== ORACLE_VERSION_MAJOR) {
+            const hint = major > ORACLE_VERSION_MAJOR ? 'The contract was compiled with a newer version of Aztec.nr than your private environment supports. Upgrade your private environment to a compatible version.' : 'The contract was compiled with an older version of Aztec.nr than your private environment supports. Recompile the contract with a compatible version of Aztec.nr.';
+            throw new Error(`Incompatible private environment version: ${hint} See https://docs.aztec.network/errors/8 (expected oracle major version ${ORACLE_VERSION_MAJOR}, got ${major})`);
         }
+        this.contractOracleVersion = {
+            major,
+            minor
+        };
     }
-    utilityGetRandomField() {
+    // Prefixed with "nonOracleFunction" as it is not used as an oracle handler.
+    nonOracleFunctionGetContractOracleVersion() {
+        return this.contractOracleVersion;
+    }
+    getRandomField() {
         return Fr.random();
     }
-    utilityGetUtilityContext() {
-        return new UtilityContext(this.anchorBlockHeader, this.contractAddress);
+    getUtilityContext() {
+        return {
+            blockHeader: this.anchorBlockHeader,
+            contractAddress: this.callContext.contractAddress,
+            msgSender: this.callContext.msgSender
+        };
     }
     /**
    * Retrieve keys associated with a specific master public key and app address.
    * @param pkMHash - The master public key hash.
+   * @param _keyIndex - Sent by the Noir oracle caller but unused here; kept to match the oracle signature.
    * @returns A Promise that resolves to nullifier keys.
    * @throws If the keys are not registered in the key store.
-   */ utilityGetKeyValidationRequest(pkMHash) {
+   * @throws If scopes are defined and the account is not in the scopes.
+   */ async getKeyValidationRequest(pkMHash, _keyIndex) {
+        let hasAccess = false;
+        for(let i = 0; i < this.scopes.length && !hasAccess; i++){
+            if (await this.keyStore.accountHasKey(this.scopes[i], pkMHash)) {
+                hasAccess = true;
+            }
+        }
+        if (!hasAccess) {
+            throw new Error(`Key validation request denied: no scoped account has a key with hash ${pkMHash.toString()}.`);
+        }
         return this.keyStore.getKeyValidationRequest(pkMHash, this.contractAddress);
     }
     /**
    * Fetches the index and sibling path of a leaf at a given block from the note hash tree.
-   * @param blockHash - The block hash at which to get the membership witness.
-   * @param leafValue - The leaf value
+   * @param blockHash - The hash of a block that contains the note hash tree root in which to find the
+   * membership witness.
+   * @param noteHash - The note hash to find in the note hash tree.
    * @returns The membership witness containing the leaf index and sibling path
-   */ utilityGetNoteHashMembershipWitness(blockHash, leafValue) {
-        return this.aztecNode.getNoteHashMembershipWitness(blockHash, leafValue);
+   */ async getNoteHashMembershipWitness(blockHash, noteHash) {
+        const witness = await this.#queryWithBlockHashNotAfterAnchor(blockHash, ()=>this.aztecNode.getNoteHashMembershipWitness(blockHash, noteHash));
+        if (!witness) {
+            throw new Error(`Note hash ${noteHash} not found in the note hash tree at block ${blockHash.toString()}.`);
+        }
+        return witness;
     }
     /**
-   * Fetches the index and sibling path of a leaf at a given block from the archive tree.
-   * @param blockHash - The block hash at which to get the membership witness.
-   * @param leafValue - The leaf value
+   * Fetches the index and sibling path of a block hash in the archive tree.
+   *
+   * Block hashes are the leaves of the archive tree. Each time a new block is added to the chain,
+   * its block hash is appended as a new leaf to the archive tree.
+   *
+   * @param referenceBlockHash - The hash of a block that contains the archive tree root in which to find the membership
+   * witness.
+   * @param blockHash - The block hash to find in the archive tree.
    * @returns The membership witness containing the leaf index and sibling path
-   */ utilityGetArchiveMembershipWitness(blockHash, leafValue) {
-        return this.aztecNode.getArchiveMembershipWitness(blockHash, leafValue);
+   */ async getBlockHashMembershipWitness(referenceBlockHash, blockHash) {
+        // Note that we validate that the reference block hash is at or before the anchor block - we don't test the block
+        // hash at all. If the block hash did not exist by the reference block hash, then the node will not return the
+        // membership witness as there is none.
+        const witness = await this.#queryWithBlockHashNotAfterAnchor(referenceBlockHash, ()=>this.aztecNode.getBlockHashMembershipWitness(referenceBlockHash, blockHash));
+        return witness ? Option.some(witness) : Option.none();
+    }
+    /** Returns whether each block hash is present in the archive tree at the referenced block. */ async areBlockHashesInArchive(referenceBlockHash, blockHashes) {
+        const hashes = blockHashes.readAll(this.ephemeralArrayService);
+        const memberships = await this.#queryWithBlockHashNotAfterAnchor(referenceBlockHash, ()=>Promise.all(hashes.map((blockHash)=>this.aztecNode.getBlockHashMembershipWitness(referenceBlockHash, blockHash).then(Boolean))));
+        return EphemeralArray.fromValues(this.ephemeralArrayService, memberships);
     }
     /**
    * Returns a nullifier membership witness for a given nullifier at a given block.
    * @param blockHash - The block hash at which to get the index.
    * @param nullifier - Nullifier we try to find witness for.
    * @returns The nullifier membership witness (if found).
-   */ utilityGetNullifierMembershipWitness(blockHash, nullifier) {
-        return this.aztecNode.getNullifierMembershipWitness(blockHash, nullifier);
+   */ async getNullifierMembershipWitness(blockHash, nullifier) {
+        const witness = await this.#queryWithBlockHashNotAfterAnchor(blockHash, ()=>this.aztecNode.getNullifierMembershipWitness(blockHash, nullifier));
+        if (!witness) {
+            throw new Error(`Nullifier membership witness not found at block ${blockHash.toString()}.`);
+        }
+        return witness;
     }
     /**
    * Returns a low nullifier membership witness for a given nullifier at a given block.
@@ -113,42 +193,63 @@ import { MessageLoadOracleInputs } from './message_load_oracle_inputs.js';
    * @remarks Low nullifier witness can be used to perform a nullifier non-inclusion proof by leveraging the "linked
    * list structure" of leaves and proving that a lower nullifier is pointing to a bigger next value than the nullifier
    * we are trying to prove non-inclusion for.
-   */ utilityGetLowNullifierMembershipWitness(blockHash, nullifier) {
-        return this.aztecNode.getLowNullifierMembershipWitness(blockHash, nullifier);
+   */ async getLowNullifierMembershipWitness(blockHash, nullifier) {
+        const witness = await this.#queryWithBlockHashNotAfterAnchor(blockHash, ()=>this.aztecNode.getLowNullifierMembershipWitness(blockHash, nullifier));
+        if (!witness) {
+            throw new Error(`Low nullifier witness not found for nullifier ${nullifier} at block hash ${blockHash.toString()}.`);
+        }
+        return witness;
     }
     /**
    * Returns a public data tree witness for a given leaf slot at a given block.
    * @param blockHash - The block hash at which to get the index.
    * @param leafSlot - The slot of the public data tree to get the witness for.
    * @returns - The witness
-   */ utilityGetPublicDataWitness(blockHash, leafSlot) {
-        return this.aztecNode.getPublicDataWitness(blockHash, leafSlot);
+   */ async getPublicDataWitness(blockHash, leafSlot) {
+        const witness = await this.#queryWithBlockHashNotAfterAnchor(blockHash, ()=>this.aztecNode.getPublicDataWitness(blockHash, leafSlot));
+        if (!witness) {
+            throw new Error(`Public data witness not found for slot ${leafSlot} at block hash ${blockHash.toString()}.`);
+        }
+        return witness;
     }
     /**
    * Fetches a block header of a given block.
    * @param blockNumber - The number of a block of which to get the block header.
    * @returns Block extracted from a block with block number `blockNumber`.
-   */ async utilityGetBlockHeader(blockNumber) {
-        const anchorBlockNumber = (await this.anchorBlockStore.getBlockHeader()).getBlockNumber();
+   */ async getBlockHeader(blockNumber) {
+        const anchorBlockNumber = this.anchorBlockHeader.getBlockNumber();
         if (blockNumber > anchorBlockNumber) {
             throw new Error(`Block number ${blockNumber} is higher than current block ${anchorBlockNumber}`);
         }
+        // Most contracts query state at the "current" block, which is the anchor. Skip the RPC when we can.
+        if (blockNumber === anchorBlockNumber) {
+            return this.anchorBlockHeader;
+        }
         const block = await this.aztecNode.getBlock(blockNumber);
-        return block?.header;
+        if (!block?.header) {
+            throw new Error(`Block header not found for block ${blockNumber}.`);
+        }
+        return block.header;
     }
     /**
-   * Retrieve the complete address associated to a given address.
+   * Retrieve the public keys and partial address associated to a given address.
    * @param account - The account address.
-   * @returns A complete address associated with the input address.
-   * @throws An error if the account is not registered in the database.
-   */ utilityGetPublicKeysAndPartialAddress(account) {
-        return this.getCompleteAddress(account);
+   * @returns The public keys and partial address, or `undefined` if the account is not registered.
+   */ async getPublicKeysAndPartialAddress(account) {
+        const completeAddress = await this.addressStore.getCompleteAddress(account);
+        if (!completeAddress) {
+            return Option.none();
+        }
+        return Option.some({
+            publicKeys: completeAddress.publicKeys,
+            partialAddress: completeAddress.partialAddress
+        });
     }
-    async getCompleteAddress(account) {
+    async getCompleteAddressOrFail(account) {
         const completeAddress = await this.addressStore.getCompleteAddress(account);
         if (!completeAddress) {
             throw new Error(`No public key registered for address ${account}.
-        Register it by calling pxe.addAccount(...).\nSee docs for context: https://docs.aztec.network/developers/resources/debugging/aztecnr-errors#simulation-error-no-public-key-registered-for-address-0x0-register-it-by-calling-pxeregisterrecipient-or-pxeregisteraccount`);
+        Register it by calling wallet.registerSender(...).\nSee docs for context: https://docs.aztec.network/errors/14`);
         }
         return completeAddress;
     }
@@ -156,23 +257,23 @@ import { MessageLoadOracleInputs } from './message_load_oracle_inputs.js';
    * Returns a contract instance associated with an address or throws if not found.
    * @param address - Address.
    * @returns A contract instance.
-   */ utilityGetContractInstance(address) {
-        return this.getContractInstance(address);
-    }
-    async getContractInstance(address) {
-        const instance = await this.contractStore.getContractInstance(address);
+   */ async getContractInstance(address) {
+        const instance = await this.anchoredContractData.getContractInstance(address);
         if (!instance) {
             throw new Error(`No contract instance found for address ${address.toString()}`);
         }
         return instance;
     }
     /**
-   * Returns an auth witness for the given message hash. Checks on the list of transient witnesses
-   * for this transaction first, and falls back to the local database if not found.
+   * Returns an auth witness for the given message hash from the list of transient witnesses for this transaction.
    * @param messageHash - Hash of the message to authenticate.
-   * @returns Authentication witness for the requested message hash.
-   */ utilityGetAuthWitness(messageHash) {
-        return Promise.resolve(this.authWitnesses.find((w)=>w.requestHash.equals(messageHash))?.witness);
+   * @returns Authentication witness for the requested message hash, or undefined if not found.
+   */ getAuthWitness(messageHash) {
+        const witness = this.authWitnesses.find((w)=>w.requestHash.equals(messageHash))?.witness;
+        if (!witness) {
+            throw new Error(`Unknown auth witness for message hash ${messageHash}`);
+        }
+        return Promise.resolve(witness);
     }
     /**
    * Gets some notes for a contract address and storage slot.
@@ -195,10 +296,10 @@ import { MessageLoadOracleInputs } from './message_load_oracle_inputs.js';
    * @param offset - The starting index for pagination.
    * @param status - The status of notes to fetch.
    * @returns Array of note data.
-   */ async utilityGetNotes(owner, storageSlot, numSelects, selectByIndexes, selectByOffsets, selectByLengths, selectValues, selectComparators, sortByIndexes, sortByOffsets, sortByLengths, sortOrder, limit, offset, status) {
-        const noteService = new NoteService(this.noteStore, this.aztecNode, this.anchorBlockStore, this.jobId);
-        const dbNotes = await noteService.getNotes(this.contractAddress, owner, storageSlot, status, this.scopes);
-        return pickNotes(dbNotes, {
+   */ async getNotes(owner, storageSlot, numSelects, selectByIndexes, selectByOffsets, selectByLengths, selectValues, selectComparators, sortByIndexes, sortByOffsets, sortByLengths, sortOrder, limit, offset, status, maxNotes, packedHintedNoteLength) {
+        const noteService = new NoteService(this.noteStore, this.aztecNode, this.anchorBlockHeader, this.jobId);
+        const dbNotes = await noteService.getNotes(this.contractAddress, owner.value, storageSlot, status, this.scopes);
+        const picked = pickNotes(dbNotes, {
             selects: selectByIndexes.slice(0, numSelects).map((index, i)=>({
                     selector: {
                         index,
@@ -219,28 +320,38 @@ import { MessageLoadOracleInputs } from './message_load_oracle_inputs.js';
             limit,
             offset
         });
+        return BoundedVec.from({
+            data: picked,
+            maxLength: maxNotes,
+            elementSize: packedHintedNoteLength
+        });
     }
     /**
    * Check if a nullifier exists in the nullifier tree.
    * @param innerNullifier - The inner nullifier.
    * @returns A boolean indicating whether the nullifier exists in the tree or not.
-   */ async utilityCheckNullifierExists(innerNullifier) {
-        const nullifier = await siloNullifier(this.contractAddress, innerNullifier);
-        const [leafIndex] = await this.aztecNode.findLeavesIndexes('latest', MerkleTreeId.NULLIFIER_TREE, [
+   */ async doesNullifierExist(innerNullifier) {
+        const [nullifier, anchorBlockHash] = await Promise.all([
+            siloNullifier(this.contractAddress, innerNullifier),
+            this.anchorBlockHeader.hash()
+        ]);
+        const [leafIndex] = await this.aztecNode.findLeavesIndexes(anchorBlockHash, MerkleTreeId.NULLIFIER_TREE, [
             nullifier
         ]);
         return leafIndex?.data !== undefined;
     }
     /**
-   * Fetches a message from the executionStore, given its key.
-   * @param contractAddress - Address of a contract by which the message was emitted.
+   * Returns the membership witness of an L1 to L2 message.
    * @param messageHash - Hash of the message.
-   * @param secret - Secret used to compute a nullifier.
-   * @dev Contract address and secret are only used to compute the nullifier to get non-nullified messages
+   * @param nullifier - When present, the unsiloed nullifier of the message and the address to silo it with. The witness
+   * is only returned if the siloed nullifier is absent from the nullifier tree, i.e. the message has not been consumed.
    * @returns The l1 to l2 membership witness (index of message in the tree and sibling path).
-   */ async utilityGetL1ToL2MembershipWitness(contractAddress, messageHash, secret) {
-        const [messageIndex, siblingPath] = await getNonNullifiedL1ToL2MessageWitness(this.aztecNode, contractAddress, messageHash, secret);
-        return new MessageLoadOracleInputs(messageIndex, siblingPath);
+   */ async getL1ToL2MembershipWitnessV2(messageHash, nullifier) {
+        const [messageIndex, siblingPath] = await getL1ToL2MessageWitness(this.aztecNode, messageHash, nullifier.value, await this.anchorBlockHeader.hash());
+        return {
+            index: messageIndex,
+            siblingPath
+        };
     }
     /**
    * Read the public storage data.
@@ -248,125 +359,527 @@ import { MessageLoadOracleInputs } from './message_load_oracle_inputs.js';
    * @param contractAddress - The address to read storage from.
    * @param startStorageSlot - The starting storage slot.
    * @param numberOfElements - Number of elements to read from the starting storage slot.
-   */ async utilityStorageRead(blockHash, contractAddress, startStorageSlot, numberOfElements) {
-        const slots = Array(numberOfElements).fill(0).map((_, i)=>new Fr(startStorageSlot.value + BigInt(i)));
-        const values = await Promise.all(slots.map((storageSlot)=>this.aztecNode.getPublicStorageAt(blockHash, contractAddress, storageSlot)));
-        this.log.debug(`Oracle storage read: slots=[${slots.map((slot)=>slot.toString()).join(', ')}] address=${contractAddress.toString()} values=[${values.join(', ')}]`);
-        return values;
+   */ getFromPublicStorage(blockHash, contractAddress, startStorageSlot, numberOfElements) {
+        return this.#queryWithBlockHashNotAfterAnchor(blockHash, async ()=>{
+            const slots = Array(numberOfElements).fill(0).map((_, i)=>new Fr(startStorageSlot.toBigInt() + BigInt(i)));
+            const values = await Promise.all(slots.map((storageSlot)=>this.aztecNode.getPublicStorageAt(blockHash, contractAddress, storageSlot)));
+            this.logger.debug(`Oracle storage read: start=${startStorageSlot.toString()} count=${numberOfElements} ` + `address=${contractAddress.toString()} values=[${values.join(', ')}]`);
+            return values;
+        });
     }
-    utilityDebugLog(level, message, fields) {
+    /**
+   * Returns a per-contract logger whose output is prefixed with `contract:<name>(<addrAbbrev>)`.
+   */ async #getContractLogger() {
+        if (!this.contractLogger) {
+            // Purpose of instanceId is to distinguish logs from different instances of the same component. It makes sense
+            // to re-use jobId as instanceId here as executions of different PXE jobs are isolated.
+            this.contractLogger = await createContractLogger(this.contractAddress, (addr)=>this.anchoredContractData.getDebugContractName(addr), 'user', {
+                instanceId: this.jobId
+            });
+        }
+        return this.contractLogger;
+    }
+    /**
+   * Returns a per-contract logger whose output is prefixed with `aztecnr:<name>(<addrAbbrev>)`.
+   */ async #getAztecnrLogger() {
+        if (!this.aztecnrLogger) {
+            // Purpose of instanceId is to distinguish logs from different instances of the same component. It makes sense
+            // to re-use jobId as instanceId here as executions of different PXE jobs are isolated.
+            this.aztecnrLogger = await createContractLogger(this.contractAddress, (addr)=>this.anchoredContractData.getDebugContractName(addr), 'aztecnr', {
+                instanceId: this.jobId
+            });
+        }
+        return this.aztecnrLogger;
+    }
+    async log(level, message, _fieldsSize, fields) {
         if (!LogLevels[level]) {
-            throw new Error(`Invalid debug log level: ${level}`);
+            throw new Error(`Invalid log level: ${level}`);
         }
-        const levelName = LogLevels[level];
-        this.aztecNrDebugLog[levelName](`${applyStringFormatting(message, fields)}`);
-    }
-    async utilityFetchTaggedLogs(pendingTaggedLogArrayBaseSlot) {
-        const logService = new LogService(this.aztecNode, this.anchorBlockStore, this.keyStore, this.capsuleStore, this.recipientTaggingStore, this.senderAddressBookStore, this.addressStore, this.jobId, this.log.getBindings());
-        const noteService = new NoteService(this.noteStore, this.aztecNode, this.anchorBlockStore, this.jobId);
-        // It is acceptable to run the following operations in parallel for several reasons:
-        // 1. syncTaggedLogs does not write to the note store — it only stores the pending tagged logs in a capsule array,
-        //    which is then processed in Noir after this handler returns.
-        // 2. Even if syncTaggedLogs did write to the note store, it would not cause inconsistent state.
+        const { kind, message: strippedMessage } = stripAztecnrLogPrefix(message);
+        const logger = kind == 'aztecnr' ? await this.#getAztecnrLogger() : await this.#getContractLogger();
+        logContractMessage(logger, LogLevels[level], strippedMessage, fields);
+    }
+    /** Fetches pending tagged logs into a freshly allocated ephemeral array and returns it. */ async getPendingTaggedLogsV2(scope, providedSecrets) {
+        const secrets = providedSecrets.readAll(this.ephemeralArrayService).map((ps)=>new AppTaggingSecret(ps.secret, this.contractAddress, ps.mode));
+        const logService = this.#createLogService();
+        const retrievedLogs = await logService.fetchTaggedLogs(this.contractAddress, scope, secrets);
+        this.#cacheValidationTxData(retrievedLogs);
+        return EphemeralArray.fromValues(this.ephemeralArrayService, retrievedLogs.map(toPendingTaggedLog));
+    }
+    #createLogService() {
+        return new LogService(this.aztecNode, this.anchorBlockHeader, this.l2TipsStore, this.keyStore, this.recipientTaggingStore, this.taggingSecretSourcesStore, this.addressStore, this.scopes, this.jobId, this.logger.getBindings());
+    }
+    async validateAndStoreEnqueuedNotesAndEvents(noteValidationRequests, eventValidationRequests, scope) {
+        await this.#processValidationRequests(noteValidationRequests.readAll(this.ephemeralArrayService), eventValidationRequests.readAll(this.ephemeralArrayService), scope);
+    }
+    async #processValidationRequests(noteValidationRequests, eventValidationRequests, scope) {
+        const validationTxData = await this.#getValidationTxData([
+            ...noteValidationRequests.map((r)=>r.txHash),
+            ...eventValidationRequests.map((r)=>r.txHash)
+        ]);
+        const noteService = new NoteService(this.noteStore, this.aztecNode, this.anchorBlockHeader, this.jobId);
+        const eventService = new EventService(this.anchorBlockHeader, this.aztecNode, this.privateEventStore, this.jobId);
         await Promise.all([
-            logService.syncTaggedLogs(this.contractAddress, pendingTaggedLogArrayBaseSlot, this.scopes),
-            noteService.syncNoteNullifiers(this.contractAddress)
+            noteService.validateAndStoreNotes(noteValidationRequests, scope, validationTxData),
+            eventService.validateAndStoreEvents(eventValidationRequests, scope, validationTxData)
         ]);
     }
+    async getLogsByTagV2(requests) {
+        const logRetrievalRequests = requests.readAll(this.ephemeralArrayService);
+        const logService = this.#createLogService();
+        const retrievedLogsPerRequest = await logService.fetchLogsByTag(this.contractAddress, logRetrievalRequests);
+        this.#cacheValidationTxData(retrievedLogsPerRequest.flat());
+        // Create an inner ephemeral array for each request's matching logs, then wrap all slots in an outer array.
+        const innerArrays = retrievedLogsPerRequest.map((retrievedLogs)=>EphemeralArray.fromValues(this.ephemeralArrayService, retrievedLogs.map(toLogRetrievalResponse)));
+        return EphemeralArray.fromValues(this.ephemeralArrayService, innerArrays);
+    }
+    /** Given an array of tx hashes, returns an aligned array of tx info if the tx is available. */ async getResolvedTxs(requests) {
+        const txHashes = requests.readAll(this.ephemeralArrayService);
+        const resolved = await this.txResolver.resolveTxs(txHashes, this.anchorBlockHeader.getBlockNumber());
+        this.#cacheValidationTxData(resolved.filter((tx)=>tx !== null));
+        const options = resolved.map((tx)=>tx ? Option.some(toResolvedTx(tx)) : Option.none());
+        return EphemeralArray.fromValues(this.ephemeralArrayService, options);
+    }
     /**
-   * Validates all note and event validation requests enqueued via `enqueue_note_for_validation` and
-   * `enqueue_event_for_validation`, inserting them into the note database and event store respectively, making them
-   * queryable via `get_notes` and `getPrivateEvents`.
-   *
-   * This automatically clears both validation request queues, so no further work needs to be done by the caller.
-   * @param contractAddress - The address of the contract that the logs are tagged for.
-   * @param noteValidationRequestsArrayBaseSlot - The base slot of capsule array containing note validation requests.
-   * @param eventValidationRequestsArrayBaseSlot - The base slot of capsule array containing event validation requests.
-   */ async utilityValidateAndStoreEnqueuedNotesAndEvents(contractAddress, noteValidationRequestsArrayBaseSlot, eventValidationRequestsArrayBaseSlot) {
-        // TODO(#10727): allow other contracts to store notes
-        if (!this.contractAddress.equals(contractAddress)) {
-            throw new Error(`Got a note validation request from ${contractAddress}, expected ${this.contractAddress}`);
+   * Fetches the effects of a transaction by its hash. Returns null if the tx is not found or is beyond the anchor
+   * block.
+   */ async getTxEffect(txHash) {
+        if (txHash.hash.isZero()) {
+            throw new Error('Invalid tx hash passed into aztec_utl_getTxEffect oracle handler');
         }
-        // We read all note and event validation requests and process them all concurrently. This makes the process much
-        // faster as we don't need to wait for the network round-trip.
-        const noteValidationRequests = (await this.capsuleStore.readCapsuleArray(contractAddress, noteValidationRequestsArrayBaseSlot, this.jobId)).map(NoteValidationRequest.fromFields);
-        const eventValidationRequests = (await this.capsuleStore.readCapsuleArray(contractAddress, eventValidationRequestsArrayBaseSlot, this.jobId)).map(EventValidationRequest.fromFields);
-        const noteService = new NoteService(this.noteStore, this.aztecNode, this.anchorBlockStore, this.jobId);
-        const noteStorePromises = noteValidationRequests.map((request)=>noteService.validateAndStoreNote(request.contractAddress, request.owner, request.storageSlot, request.randomness, request.noteNonce, request.content, request.noteHash, request.nullifier, request.txHash, request.recipient));
-        const eventService = new EventService(this.anchorBlockStore, this.aztecNode, this.privateEventStore, this.jobId);
-        const eventStorePromises = eventValidationRequests.map((request)=>eventService.validateAndStoreEvent(request.contractAddress, request.eventTypeId, request.randomness, request.serializedEvent, request.eventCommitment, request.txHash, request.recipient));
-        await Promise.all([
-            ...noteStorePromises,
-            ...eventStorePromises
-        ]);
-        // Requests are cleared once we're done.
-        await this.capsuleStore.setCapsuleArray(contractAddress, noteValidationRequestsArrayBaseSlot, [], this.jobId);
-        await this.capsuleStore.setCapsuleArray(contractAddress, eventValidationRequestsArrayBaseSlot, [], this.jobId);
-    }
-    async utilityBulkRetrieveLogs(contractAddress, logRetrievalRequestsArrayBaseSlot, logRetrievalResponsesArrayBaseSlot) {
-        // TODO(#10727): allow other contracts to process partial notes
-        if (!this.contractAddress.equals(contractAddress)) {
-            throw new Error(`Got a note validation request from ${contractAddress}, expected ${this.contractAddress}`);
+        return await this.#getTxEffectOption(txHash);
+    }
+    /** Fetches transaction effects for all hashes, preserving request order. */ async getTxEffects(txHashes) {
+        const hashes = txHashes.readAll(this.ephemeralArrayService);
+        const invalidHash = hashes.find((txHash)=>txHash.hash.isZero());
+        if (invalidHash) {
+            throw new Error('Invalid tx hash passed into aztec_utl_getTxEffects oracle handler');
         }
-        // We read all log retrieval requests and process them all concurrently. This makes the process much faster as we
-        // don't need to wait for the network round-trip.
-        const logRetrievalRequests = (await this.capsuleStore.readCapsuleArray(contractAddress, logRetrievalRequestsArrayBaseSlot, this.jobId)).map(LogRetrievalRequest.fromFields);
-        const logService = new LogService(this.aztecNode, this.anchorBlockStore, this.keyStore, this.capsuleStore, this.recipientTaggingStore, this.senderAddressBookStore, this.addressStore, this.jobId, this.log.getBindings());
-        const maybeLogRetrievalResponses = await logService.bulkRetrieveLogs(logRetrievalRequests);
-        // Requests are cleared once we're done.
-        await this.capsuleStore.setCapsuleArray(contractAddress, logRetrievalRequestsArrayBaseSlot, [], this.jobId);
-        // The responses are stored as Option<LogRetrievalResponse> in a second CapsuleArray.
-        await this.capsuleStore.setCapsuleArray(contractAddress, logRetrievalResponsesArrayBaseSlot, maybeLogRetrievalResponses.map(LogRetrievalResponse.toSerializedOption), this.jobId);
-    }
-    utilityStoreCapsule(contractAddress, slot, capsule) {
+        const uniqueTxHashes = uniqueBy(hashes, (h)=>h.toString());
+        const options = await Promise.all(uniqueTxHashes.map((txHash)=>this.#getTxEffectOption(txHash)));
+        const optionsByHash = new Map(uniqueTxHashes.map((txHash, i)=>[
+                txHash.toString(),
+                options[i]
+            ]));
+        return EphemeralArray.fromValues(this.ephemeralArrayService, hashes.map((txHash)=>optionsByHash.get(txHash.toString())));
+    }
+    setCapsule(contractAddress, slot, capsule, scope) {
+        this.#assertOwnContract(contractAddress);
+        this.capsuleService.setCapsule(contractAddress, slot, capsule, this.jobId, scope);
+    }
+    async getCapsule(contractAddress, slot, tSize, scope) {
+        this.#assertOwnContract(contractAddress);
+        const values = await this.capsuleService.getCapsule(contractAddress, slot, this.jobId, scope, this.capsules);
+        return values ? Option.some(values) : Option.none({
+            length: tSize
+        });
+    }
+    deleteCapsule(contractAddress, slot, scope) {
+        this.#assertOwnContract(contractAddress);
+        this.capsuleService.deleteCapsule(contractAddress, slot, this.jobId, scope);
+    }
+    copyCapsule(contractAddress, srcSlot, dstSlot, numEntries, scope) {
+        this.#assertOwnContract(contractAddress);
+        return this.capsuleService.copyCapsule(contractAddress, srcSlot, dstSlot, numEntries, this.jobId, scope);
+    }
+    /**
+   * Asserts the executing contract may only access its own slice of PXE DB.
+   */ #assertOwnContract(contractAddress) {
         if (!contractAddress.equals(this.contractAddress)) {
-            // TODO(#10727): instead of this check that this.contractAddress is allowed to access the external DB
             throw new Error(`Contract ${contractAddress} is not allowed to access ${this.contractAddress}'s PXE DB`);
         }
-        this.capsuleStore.storeCapsule(this.contractAddress, slot, capsule, this.jobId);
-        return Promise.resolve();
     }
-    async utilityLoadCapsule(contractAddress, slot) {
+    /**
+   * Records a fact into a collection. A `Some` origin block makes the fact retractable (pruned on reorg of that
+   * block), a `None` origin block makes it non-retractable, surviving reorgs.
+   */ recordFact(contractAddress, scope, factCollectionTypeId, factCollectionId, factTypeId, payload, originBlock) {
+        this.#assertOwnContract(contractAddress);
+        return this.factService.recordFact(new FactCollectionKey(contractAddress, scope, factCollectionTypeId, factCollectionId), factTypeId, payload.readAll(this.ephemeralArrayService), originBlock.isSome() ? originBlock.value : undefined, this.jobId);
+    }
+    /**
+   * Deletes a fact collection, removing all its facts. A no-op if no such collection exists.
+   */ deleteFactCollection(contractAddress, scope, factCollectionTypeId, factCollectionId) {
+        this.#assertOwnContract(contractAddress);
+        return this.factService.deleteFactCollection(new FactCollectionKey(contractAddress, scope, factCollectionTypeId, factCollectionId), this.jobId);
+    }
+    /**
+   * Returns a fact collection.
+   */ async getFactCollection(contractAddress, scope, factCollectionTypeId, factCollectionId) {
+        this.#assertOwnContract(contractAddress);
+        const tips = anchoredTipBlockNumbers(await this.l2TipsStore.getL2Tips(), this.anchorBlockHeader.getBlockNumber());
+        const collection = await this.factService.getFactCollection(new FactCollectionKey(contractAddress, scope, factCollectionTypeId, factCollectionId), tips, this.jobId);
+        return collection ? Option.some(toNoirFactCollection(this.ephemeralArrayService, contractAddress, scope, factCollectionTypeId, factCollectionId, collection.facts)) : Option.none(emptyFactCollection(this.ephemeralArrayService));
+    }
+    /** Returns every fact collection of `factCollectionTypeId`. */ async getFactCollectionsByType(contractAddress, scope, factCollectionTypeId) {
+        this.#assertOwnContract(contractAddress);
+        const tips = anchoredTipBlockNumbers(await this.l2TipsStore.getL2Tips(), this.anchorBlockHeader.getBlockNumber());
+        const collections = await this.factService.getFactCollectionsByType(new FactCollectionTypeKey(contractAddress, scope, factCollectionTypeId), tips, this.jobId);
+        return EphemeralArray.fromValues(this.ephemeralArrayService, collections.map((collection)=>toNoirFactCollection(this.ephemeralArrayService, collection.key.contractAddress, collection.key.scope, collection.key.factCollectionTypeId, collection.key.factCollectionId, collection.facts)));
+    }
+    /**
+   * Clears cached sync state for a contract for a set of scopes, forcing re-sync on the next query so that newly
+   * stored notes or events are discovered.
+   */ setContractSyncCacheInvalid(contractAddress, scopes) {
         if (!contractAddress.equals(this.contractAddress)) {
-            // TODO(#10727): instead of this check that this.contractAddress is allowed to access the external DB
-            throw new Error(`Contract ${contractAddress} is not allowed to access ${this.contractAddress}'s PXE DB`);
+            throw new Error(`Contract ${this.contractAddress} cannot invalidate sync cache of ${contractAddress}`);
         }
-        return(// TODO(#12425): On the following line, the pertinent capsule gets overshadowed by the transient one. Tackle this.
-        this.capsules.find((c)=>c.contractAddress.equals(contractAddress) && c.storageSlot.equals(slot))?.data ?? await this.capsuleStore.loadCapsule(this.contractAddress, slot, this.jobId));
+        this.contractSyncService.invalidateContractForScopes(contractAddress, scopes.data);
     }
-    utilityDeleteCapsule(contractAddress, slot) {
+    // TODO(#11849): consider replacing this oracle with a pure Noir implementation of aes decryption.
+    async decryptAes128(ciphertext, iv, symKey) {
+        const capacity = ciphertext.maxLength;
+        try {
+            const aes128 = new Aes128();
+            const plaintext = await aes128.decryptBufferCBC(Buffer.from(ciphertext.data), Buffer.from(iv), Buffer.from(symKey));
+            return Option.some(BoundedVec.from({
+                data: [
+                    ...plaintext
+                ],
+                maxLength: capacity
+            }));
+        } catch  {
+            return Option.none({
+                maxLength: capacity
+            });
+        }
+    }
+    /**
+   * Retrieves app-siloed shared secrets for multiple ephemeral public keys stored in an ephemeral array.
+   * @param address - The recipient address.
+   * @param ephPks - Ephemeral array containing the serialized Points.
+   * @param contractAddress - The contract address for app-siloing (validated against execution context).
+   * @returns A new ephemeral array containing the computed shared secrets, or an empty array when the PXE does not
+   * hold the keys for `address`.
+   * @throws If `address` is not in the execution's allowed scopes.
+   */ async getSharedSecrets(address, ephPks, contractAddress) {
         if (!contractAddress.equals(this.contractAddress)) {
-            // TODO(#10727): instead of this check that this.contractAddress is allowed to access the external DB
-            throw new Error(`Contract ${contractAddress} is not allowed to access ${this.contractAddress}'s PXE DB`);
+            throw new Error(`getSharedSecrets called with contract address ${contractAddress}, expected ${this.contractAddress}`);
         }
-        this.capsuleStore.deleteCapsule(this.contractAddress, slot, this.jobId);
+        assertAllowedScope(address, this.scopes);
+        // An address can be in scope without the PXE holding its keys (e.g. syncing a registered but non-owned account),
+        // in which case no secrets can be derived and we return an empty array rather than failing.
+        const recipientCompleteAddress = await this.addressStore.getCompleteAddress(address);
+        if (!recipientCompleteAddress) {
+            this.logger.warn(`Computing shared secrets for address ${address} whose keys are not held - returning no secrets`, {
+                address,
+                contractAddress: this.contractAddress
+            });
+            return EphemeralArray.fromValues(this.ephemeralArrayService, []);
+        }
+        const ivpkMHash = await hashPublicKey(recipientCompleteAddress.publicKeys.ivpkM);
+        const ivskM = await this.keyStore.getMasterSecretKey(ivpkMHash);
+        const addressSecret = await computeAddressSecret(await recipientCompleteAddress.getPreaddress(), ivskM);
+        const ephPkPoints = ephPks.readAll(this.ephemeralArrayService);
+        const secrets = await Promise.all(ephPkPoints.map(({ x, y })=>appSiloEcdhSharedSecret(addressSecret, new Point(x, y), this.contractAddress)));
+        return EphemeralArray.fromValues(this.ephemeralArrayService, secrets);
+    }
+    pushEphemeral(slot, elements) {
+        return this.ephemeralArrayService.push(slot, elements);
+    }
+    popEphemeral(slot) {
+        return this.ephemeralArrayService.pop(slot);
+    }
+    getEphemeral(slot, index) {
+        return this.ephemeralArrayService.get(slot, index);
+    }
+    setEphemeral(slot, index, elements) {
+        this.ephemeralArrayService.set(slot, index, elements);
+    }
+    getEphemeralLen(slot) {
+        return this.ephemeralArrayService.len(slot);
+    }
+    removeEphemeral(slot, index) {
+        this.ephemeralArrayService.remove(slot, index);
+    }
+    clearEphemeral(slot) {
+        this.ephemeralArrayService.clear(slot);
+    }
+    pushTransient(slot, elements) {
+        return this.transientArrayService.push(this.contractAddress, slot, elements);
+    }
+    popTransient(slot) {
+        return this.transientArrayService.pop(this.contractAddress, slot);
+    }
+    getTransient(slot, index) {
+        return this.transientArrayService.get(this.contractAddress, slot, index);
+    }
+    setTransient(slot, index, elements) {
+        this.transientArrayService.set(this.contractAddress, slot, index, elements);
+    }
+    getTransientLen(slot) {
+        return this.transientArrayService.len(this.contractAddress, slot);
+    }
+    removeTransient(slot, index) {
+        this.transientArrayService.remove(this.contractAddress, slot, index);
+    }
+    clearTransient(slot) {
+        this.transientArrayService.clear(this.contractAddress, slot);
+    }
+    emitOffchainEffect(data) {
+        this.offchainEffects.push({
+            data,
+            contractAddress: this.contractAddress
+        });
         return Promise.resolve();
     }
-    utilityCopyCapsule(contractAddress, srcSlot, dstSlot, numEntries) {
-        if (!contractAddress.equals(this.contractAddress)) {
-            // TODO(#10727): instead of this check that this.contractAddress is allowed to access the external DB
-            throw new Error(`Contract ${contractAddress} is not allowed to access ${this.contractAddress}'s PXE DB`);
+    /** Executes another utility function from within this one and returns its serialized return values. */ async callUtilityFunction(targetContractAddress, functionSelector, args) {
+        const targetArtifact = await this.anchoredContractData.getFunctionArtifactWithDebugMetadata(targetContractAddress, functionSelector);
+        if (!targetArtifact) {
+            throw new Error(`Cannot call ${targetContractAddress}:${functionSelector}: the contract is not registered. ` + `Register it via wallet.registerContract(...).`);
+        }
+        if (!targetContractAddress.equals(this.contractAddress)) {
+            // Standard handshake registry reads are authorized by default; every other cross-contract call needs the hook.
+            if (!await isStandardHandshakeRegistryUtilityRead(targetContractAddress, functionSelector)) {
+                const [callerClassId, targetClassId] = await Promise.all([
+                    this.anchoredContractData.getCurrentClassId(this.contractAddress),
+                    this.anchoredContractData.getCurrentClassId(targetContractAddress)
+                ]);
+                if (!callerClassId || !targetClassId) {
+                    throw new Error(`Cannot authorize utility call from ${this.contractAddress} to ${targetContractAddress}: ` + `${!callerClassId ? this.contractAddress : targetContractAddress} is not registered.`);
+                }
+                const request = {
+                    caller: this.contractAddress,
+                    callerClassId,
+                    target: targetContractAddress,
+                    targetClassId,
+                    functionSelector,
+                    functionName: targetArtifact.name,
+                    args,
+                    callerContext: this.callerContext
+                };
+                const response = this.hooks?.authorizeUtilityCall ? await this.hooks.authorizeUtilityCall(request) : {
+                    authorized: false,
+                    reason: 'No authorizeUtilityCall hook configured'
+                };
+                if (!response.authorized) {
+                    const reason = response.reason ? `: ${response.reason}` : '';
+                    throw new Error(`Cross-contract utility call denied${reason}. ${this.contractAddress} attempted to call ` + `${targetContractAddress}:${functionSelector} (${targetArtifact.name}). ` + `See https://docs.aztec.network/errors/11`);
+                }
+            }
+            await this.contractSyncService.ensureContractSynced(targetContractAddress, functionSelector, this.utilityExecutor, this.anchorBlockHeader, this.jobId, this.scopes);
         }
-        return this.capsuleStore.copyCapsule(this.contractAddress, srcSlot, dstSlot, numEntries, this.jobId);
+        this.logger.debug(`Calling nested utility function ${targetContractAddress}:${functionSelector} from ${this.contractAddress}`);
+        const nestedOracle = new UtilityExecutionOracle({
+            callContext: CallContext.from({
+                msgSender: this.contractAddress,
+                contractAddress: targetContractAddress,
+                functionSelector,
+                isStaticCall: true
+            }),
+            authWitnesses: this.authWitnesses,
+            capsules: this.capsules,
+            anchorBlockHeader: this.anchorBlockHeader,
+            anchoredContractData: this.anchoredContractData,
+            noteStore: this.noteStore,
+            keyStore: this.keyStore,
+            addressStore: this.addressStore,
+            aztecNode: this.aztecNode,
+            recipientTaggingStore: this.recipientTaggingStore,
+            taggingSecretSourcesStore: this.taggingSecretSourcesStore,
+            capsuleService: this.capsuleService,
+            factService: this.factService,
+            privateEventStore: this.privateEventStore,
+            txResolver: this.txResolver,
+            contractSyncService: this.contractSyncService,
+            l2TipsStore: this.l2TipsStore,
+            jobId: this.jobId,
+            scopes: this.scopes,
+            simulator: this.simulator,
+            hooks: this.hooks,
+            utilityExecutor: this.utilityExecutor,
+            log: this.logger,
+            // Shared across the whole execution tree: nested utility frames inherit the caller's transient-array store.
+            transientArrayService: this.transientArrayService
+        });
+        const initialWitness = toACVMWitness(0, args);
+        const acirExecutionResult = await this.simulator.executeUserCircuit(initialWitness, targetArtifact, buildACIRCallback(nestedOracle)).catch((err)=>{
+            err.message = resolveAssertionMessageFromError(err, targetArtifact);
+            throw new ExecutionError(err.message, {
+                contractAddress: targetContractAddress,
+                functionSelector
+            }, extractCallStack(err, targetArtifact.debug), {
+                cause: err
+            });
+        });
+        return witnessMapToFields(acirExecutionResult.returnWitness);
     }
-    // TODO(#11849): consider replacing this oracle with a pure Noir implementation of aes decryption.
-    utilityAes128Decrypt(ciphertext, iv, symKey) {
-        const aes128 = new Aes128();
-        return aes128.decryptBufferCBC(ciphertext, iv, symKey);
+    /** Returns offchain effects collected during execution. */ getOffchainEffects() {
+        return this.offchainEffects;
+    }
+    /** Stores the onchain context of the given txs, so that validating the notes and events they created is free. */ #cacheValidationTxData(txs) {
+        txs.forEach((tx)=>this.validationTxDataCache.set(tx.txHash.toString(), toValidationTxData(tx)));
     }
     /**
-   * Retrieves the shared secret for a given address and ephemeral public key.
-   * @param address - The address to get the secret for.
-   * @param ephPk - The ephemeral public key to get the secret for.
-   * @returns The secret for the given address.
-   */ utilityGetSharedSecret(address, ephPk) {
-        return this.getSharedSecret(address, ephPk);
-    }
-    async getSharedSecret(address, ephPk) {
-        // TODO(#12656): return an app-siloed secret
-        const recipientCompleteAddress = await this.getCompleteAddress(address);
-        const ivskM = await this.keyStore.getMasterSecretKey(recipientCompleteAddress.publicKeys.masterIncomingViewingPublicKey);
-        const addressSecret = await computeAddressSecret(await recipientCompleteAddress.getPreaddress(), ivskM);
-        return deriveEcdhSharedSecret(addressSecret, ephPk);
+   * Returns the information needed to validate the notes and events created in the given txs, keyed by
+   * `TxHash.toString()`. Txs already in {@link validationTxDataCache} cost no node request, and the rest are read from
+   * the node. Txs with no tx effect are absent from the returned map.
+   */ async #getValidationTxData(txHashes) {
+        const known = [];
+        const misses = [];
+        for (const txHash of uniqueBy(txHashes, (h)=>h.toString())){
+            const key = txHash.toString();
+            const cached = this.validationTxDataCache.get(key);
+            if (cached) {
+                known.push([
+                    key,
+                    cached
+                ]);
+            } else {
+                misses.push(txHash);
+            }
+        }
+        const fetched = await Promise.all(misses.map((h)=>this.#getTxReceiptWithEffect(h)));
+        return new Map([
+            ...known,
+            ...misses.map((h, i)=>{
+                const receipt = fetched[i];
+                if (!receipt.isMined() || !receipt.txEffect) {
+                    return [
+                        h.toString(),
+                        undefined
+                    ];
+                }
+                return [
+                    h.toString(),
+                    {
+                        noteHashes: receipt.txEffect.noteHashes,
+                        nullifiers: receipt.txEffect.nullifiers,
+                        l2BlockNumber: receipt.blockNumber,
+                        l2BlockHash: receipt.blockHash,
+                        txIndexInBlock: receipt.txIndexInBlock
+                    }
+                ];
+            }).filter((entry)=>entry[1] !== undefined)
+        ]);
+    }
+    /**
+   * Reads a receipt with its effect, at most once per tx for the lifetime of this execution.
+   *
+   * A receipt is not cacheable in general, since pending, mined and dropped are all correct answers to the same call
+   * over time. Within one execution it is: the execution is anchored at a fixed block, and validation runs in several
+   * batches that name overlapping tx hashes, so re-reading would both cost extra requests and let one execution see a
+   * tx as included in one batch and absent in the next.
+   */ #getTxReceiptWithEffect(txHash) {
+        const key = txHash.toString();
+        let receipt = this.txReceiptsCache.get(key);
+        if (!receipt) {
+            receipt = this.aztecNode.getTxReceipt(txHash, {
+                includeTxEffect: true
+            }).catch((err)=>{
+                this.txReceiptsCache.delete(key);
+                throw err;
+            });
+            this.txReceiptsCache.set(key, receipt);
+        }
+        return receipt;
+    }
+    async #getTxEffectOption(txHash) {
+        const receipt = await this.#getTxReceiptWithEffect(txHash);
+        if (!receipt.isMined() || !receipt.txEffect || receipt.blockNumber > this.anchorBlockHeader.getBlockNumber()) {
+            return Option.none();
+        }
+        return Option.some(this.#toTxEffectData(receipt.txEffect));
+    }
+    #toTxEffectData(txEffect) {
+        return {
+            ...txEffect,
+            revertCode: txEffect.revertCode.getCode(),
+            publicLogs: FlatPublicLogs.fromLogs(txEffect.publicLogs),
+            contractClassLogs: txEffect.contractClassLogs.map((log)=>({
+                    contractAddress: log.contractAddress,
+                    fields: log.fields.toFields(),
+                    emittedLength: log.emittedLength
+                }))
+        };
     }
+    /** Runs a query concurrently with a validation that the block hash is not ahead of the anchor block. */ async #queryWithBlockHashNotAfterAnchor(blockHash, query) {
+        // Most contracts query state at the "current" block, which is the anchor. Skip the validation when we can.
+        const anchorHash = await this.anchorBlockHeader.hash();
+        if (blockHash.equals(anchorHash)) {
+            return query();
+        }
+        const [response] = await Promise.all([
+            query(),
+            (async ()=>{
+                const block = await this.aztecNode.getBlock(blockHash);
+                const header = block?.header;
+                if (!header) {
+                    throw new Error(`Could not find block header for block hash ${blockHash}`);
+                }
+                if (header.getBlockNumber() > this.anchorBlockHeader.getBlockNumber()) {
+                    throw new Error(`Made a node query with a reference block hash ${blockHash} with block number ${header.getBlockNumber()}, which is ahead of the anchor block number ${this.anchorBlockHeader.getBlockNumber()} (from anchor block hash ${anchorHash}).`);
+                }
+            })()
+        ]);
+        return response;
+    }
+    /** The execution context of the current call. */ get callerContext() {
+        return 'utility';
+    }
+    /** The address of the contract whose function is being executed, from the call context. */ get contractAddress() {
+        return this.callContext.contractAddress;
+    }
+}
+// Registry reads that any contract may issue without an `authorizeUtilityCall` hook. The constrained-delivery
+// library calls these implicitly for the app, and they are safe to default-authorize: `get_app_siloed_secrets`
+// siloes every returned secret to `msg_sender`, and `get_non_interactive_handshakes` only exposes ephemeral public
+// keys, from which the shared secret cannot be derived without the recipient's secret keys.
+const STANDARD_HANDSHAKE_REGISTRY_DEFAULT_AUTHORIZED_READ_SIGNATURES = [
+    'get_non_interactive_handshakes((Field),u32)',
+    'get_app_siloed_secrets((Field),(Field))'
+];
+async function doesSelectorHaveSignature(functionSelector, signature) {
+    return functionSelector.equals(await FunctionSelector.fromSignature(signature));
+}
+/**
+ * Whether a cross-contract utility call targets one of the standard handshake registry's read functions.
+ *
+ * These reads are authorized by PXE for every wallet, without consulting the `authorizeUtilityCall` hook, so that
+ * wallets don't need to know the handshake registry exists in order to deliver and discover messages through it.
+ */ async function isStandardHandshakeRegistryUtilityRead(targetContractAddress, functionSelector) {
+    if (!targetContractAddress.equals(STANDARD_HANDSHAKE_REGISTRY_ADDRESS)) {
+        return false;
+    }
+    const matches = await Promise.all(STANDARD_HANDSHAKE_REGISTRY_DEFAULT_AUTHORIZED_READ_SIGNATURES.map((signature)=>doesSelectorHaveSignature(functionSelector, signature)));
+    return matches.some(Boolean);
+}
+function toPendingTaggedLog(retrievedLog) {
+    return {
+        log: retrievedLog.logData,
+        context: toResolvedTx(retrievedLog)
+    };
+}
+function toResolvedTx(tx) {
+    const { txHash, blockNumber, blockHash, noteHashes, nullifiers } = tx;
+    return {
+        txHash,
+        uniqueNoteHashesInTx: noteHashes,
+        firstNullifierInTx: nullifiers[0],
+        blockNumber,
+        blockHash: blockHash.toFr()
+    };
+}
+function toLogRetrievalResponse(retrievedLog) {
+    const { logData, txHash, blockNumber, blockHash, blockTimestamp, noteHashes, nullifiers } = retrievedLog;
+    return {
+        // Skip the tag, and clip to the wire cap: public logs can exceed PRIVATE_LOG_CIPHERTEXT_LEN, which is the fixed
+        // size of the oracle's BoundedVec slot. A no-op for private logs, which are already within the cap.
+        logPayload: logData.slice(1, 1 + PRIVATE_LOG_CIPHERTEXT_LEN),
+        txHash,
+        uniqueNoteHashesInTx: noteHashes,
+        firstNullifierInTx: nullifiers[0],
+        blockNumber,
+        blockTimestamp,
+        blockHash
+    };
+}
+function toValidationTxData(tx) {
+    const { blockNumber, blockHash, txIndexInBlock, noteHashes, nullifiers } = tx;
+    return {
+        noteHashes,
+        nullifiers,
+        l2BlockNumber: blockNumber,
+        l2BlockHash: blockHash,
+        txIndexInBlock
+    };
 }