@aztec/pxe 0.0.1-commit.d431d1c → 0.0.1-commit.e2b2873ed

package/src/contract_function_simulator/oracle/utility_execution_oracle.ts

@@ -1,18 +1,21 @@
+import type { ARCHIVE_HEIGHT, NOTE_HASH_TREE_HEIGHT } from '@aztec/constants';
 import type { BlockNumber } from '@aztec/foundation/branded-types';
 import { Aes128 } from '@aztec/foundation/crypto/aes128';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { Point } from '@aztec/foundation/curves/grumpkin';
-import { LogLevels, applyStringFormatting, createLogger } from '@aztec/foundation/log';
+import { LogLevels, type Logger, applyStringFormatting, createLogger } from '@aztec/foundation/log';
+import type { MembershipWitness } from '@aztec/foundation/trees';
 import type { KeyStore } from '@aztec/key-store';
 import type { AuthWitness } from '@aztec/stdlib/auth-witness';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
-import { L2BlockHash } from '@aztec/stdlib/block';
+import { BlockHash } from '@aztec/stdlib/block';
 import type { CompleteAddress, ContractInstance } from '@aztec/stdlib/contract';
 import { siloNullifier } from '@aztec/stdlib/hash';
 import type { AztecNode } from '@aztec/stdlib/interfaces/server';
 import type { KeyValidationRequest } from '@aztec/stdlib/kernel';
 import { computeAddressSecret } from '@aztec/stdlib/keys';
 import { deriveEcdhSharedSecret } from '@aztec/stdlib/logs';
+import { getNonNullifiedL1ToL2MessageWitness } from '@aztec/stdlib/messaging';
 import type { NoteStatus } from '@aztec/stdlib/note';
 import { MerkleTreeId, type NullifierMembershipWitness, PublicDataWitness } from '@aztec/stdlib/trees';
 import type { BlockHeader, Capsule } from '@aztec/stdlib/tx';
@@ -22,14 +25,12 @@ import { LogService } from '../../logs/log_service.js';
 import { NoteService } from '../../notes/note_service.js';
 import { ORACLE_VERSION } from '../../oracle_version.js';
 import type { AddressStore } from '../../storage/address_store/address_store.js';
-import type { AnchorBlockStore } from '../../storage/anchor_block_store/anchor_block_store.js';
 import type { CapsuleStore } from '../../storage/capsule_store/capsule_store.js';
 import type { ContractStore } from '../../storage/contract_store/contract_store.js';
 import type { NoteStore } from '../../storage/note_store/note_store.js';
 import type { PrivateEventStore } from '../../storage/private_event_store/private_event_store.js';
 import type { RecipientTaggingStore } from '../../storage/tagging_store/recipient_tagging_store.js';
 import type { SenderAddressBookStore } from '../../storage/tagging_store/sender_address_book_store.js';
-import { TreeMembershipService } from '../../tree_membership/tree_membership_service.js';
 import { EventValidationRequest } from '../noir-structs/event_validation_request.js';
 import { LogRetrievalRequest } from '../noir-structs/log_retrieval_request.js';
 import { LogRetrievalResponse } from '../noir-structs/log_retrieval_response.js';
@@ -39,6 +40,27 @@ import { pickNotes } from '../pick_notes.js';
 import type { IMiscOracle, IUtilityExecutionOracle, NoteData } from './interfaces.js';
 import { MessageLoadOracleInputs } from './message_load_oracle_inputs.js';
 
+/** Args for UtilityExecutionOracle constructor. */
+export type UtilityExecutionOracleArgs = {
+  contractAddress: AztecAddress;
+  /** List of transient auth witnesses to be used during this simulation */
+  authWitnesses: AuthWitness[];
+  capsules: Capsule[]; // TODO(#12425): Rename to transientCapsules
+  anchorBlockHeader: BlockHeader;
+  contractStore: ContractStore;
+  noteStore: NoteStore;
+  keyStore: KeyStore;
+  addressStore: AddressStore;
+  aztecNode: AztecNode;
+  recipientTaggingStore: RecipientTaggingStore;
+  senderAddressBookStore: SenderAddressBookStore;
+  capsuleStore: CapsuleStore;
+  privateEventStore: PrivateEventStore;
+  jobId: string;
+  log?: ReturnType<typeof createLogger>;
+  scopes?: AztecAddress[];
+};
+
 /**
  * The oracle for an execution of utility contract functions.
  */
@@ -46,28 +68,43 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
   isMisc = true as const;
   isUtility = true as const;
 
-  private aztecNrDebugLog = createLogger('aztec-nr:debug_log');
-
-  constructor(
-    protected readonly contractAddress: AztecAddress,
-    /** List of transient auth witnesses to be used during this simulation */
-    protected readonly authWitnesses: AuthWitness[],
-    protected readonly capsules: Capsule[], // TODO(#12425): Rename to transientCapsules
-    protected readonly anchorBlockHeader: BlockHeader,
-    protected readonly contractStore: ContractStore,
-    protected readonly noteStore: NoteStore,
-    protected readonly keyStore: KeyStore,
-    protected readonly addressStore: AddressStore,
-    protected readonly aztecNode: AztecNode,
-    protected readonly anchorBlockStore: AnchorBlockStore,
-    protected readonly recipientTaggingStore: RecipientTaggingStore,
-    protected readonly senderAddressBookStore: SenderAddressBookStore,
-    protected readonly capsuleStore: CapsuleStore,
-    protected readonly privateEventStore: PrivateEventStore,
-    protected readonly jobId: string,
-    protected log = createLogger('simulator:client_view_context'),
-    protected readonly scopes?: AztecAddress[],
-  ) {}
+  private contractLogger: Logger | undefined;
+
+  protected readonly contractAddress: AztecAddress;
+  protected readonly authWitnesses: AuthWitness[];
+  protected readonly capsules: Capsule[];
+  protected readonly anchorBlockHeader: BlockHeader;
+  protected readonly contractStore: ContractStore;
+  protected readonly noteStore: NoteStore;
+  protected readonly keyStore: KeyStore;
+  protected readonly addressStore: AddressStore;
+  protected readonly aztecNode: AztecNode;
+  protected readonly recipientTaggingStore: RecipientTaggingStore;
+  protected readonly senderAddressBookStore: SenderAddressBookStore;
+  protected readonly capsuleStore: CapsuleStore;
+  protected readonly privateEventStore: PrivateEventStore;
+  protected readonly jobId: string;
+  protected log: ReturnType<typeof createLogger>;
+  protected readonly scopes?: AztecAddress[];
+
+  constructor(args: UtilityExecutionOracleArgs) {
+    this.contractAddress = args.contractAddress;
+    this.authWitnesses = args.authWitnesses;
+    this.capsules = args.capsules;
+    this.anchorBlockHeader = args.anchorBlockHeader;
+    this.contractStore = args.contractStore;
+    this.noteStore = args.noteStore;
+    this.keyStore = args.keyStore;
+    this.addressStore = args.addressStore;
+    this.aztecNode = args.aztecNode;
+    this.recipientTaggingStore = args.recipientTaggingStore;
+    this.senderAddressBookStore = args.senderAddressBookStore;
+    this.capsuleStore = args.capsuleStore;
+    this.privateEventStore = args.privateEventStore;
+    this.jobId = args.jobId;
+    this.log = args.log ?? createLogger('simulator:client_view_context');
+    this.scopes = args.scopes;
+  }
 
   public utilityAssertCompatibleOracleVersion(version: number): void {
     if (version !== ORACLE_VERSION) {
@@ -88,21 +125,54 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
    * @param pkMHash - The master public key hash.
    * @returns A Promise that resolves to nullifier keys.
    * @throws If the keys are not registered in the key store.
+   * @throws If scopes are defined and the account is not in the scopes.
    */
-  public utilityGetKeyValidationRequest(pkMHash: Fr): Promise<KeyValidationRequest> {
+  public async utilityGetKeyValidationRequest(pkMHash: Fr): Promise<KeyValidationRequest> {
+    // If scopes are defined, check that the key belongs to an account in the scopes.
+    if (this.scopes && this.scopes.length > 0) {
+      let hasAccess = false;
+      for (let i = 0; i < this.scopes.length && !hasAccess; i++) {
+        if (await this.keyStore.accountHasKey(this.scopes[i], pkMHash)) {
+          hasAccess = true;
+        }
+      }
+      if (!hasAccess) {
+        throw new Error(`Key validation request denied: no scoped account has a key with hash ${pkMHash.toString()}.`);
+      }
+    }
     return this.keyStore.getKeyValidationRequest(pkMHash, this.contractAddress);
   }
 
   /**
-   * Fetches the index and sibling path of a leaf at a given block from a given tree.
-   * @param blockHash - The block hash at which to get the membership witness.
-   * @param treeId - Id of the tree to get the sibling path from.
-   * @param leafValue - The leaf value
-   * @returns The index and sibling path concatenated [index, sibling_path]
+   * Fetches the index and sibling path of a leaf at a given block from the note hash tree.
+   * @param anchorBlockHash - The hash of a block that contains the note hash tree root in which to find the membership
+   * witness.
+   * @param noteHash - The note hash to find in the note hash tree.
+   * @returns The membership witness containing the leaf index and sibling path
+   */
+  public utilityGetNoteHashMembershipWitness(
+    anchorBlockHash: BlockHash,
+    noteHash: Fr,
+  ): Promise<MembershipWitness<typeof NOTE_HASH_TREE_HEIGHT> | undefined> {
+    return this.aztecNode.getNoteHashMembershipWitness(anchorBlockHash, noteHash);
+  }
+
+  /**
+   * Fetches the index and sibling path of a block hash in the archive tree.
+   *
+   * Block hashes are the leaves of the archive tree. Each time a new block is added to the chain,
+   * its block hash is appended as a new leaf to the archive tree.
+   *
+   * @param anchorBlockHash - The hash of a block that contains the archive tree root in which to find the membership
+   * witness.
+   * @param blockHash - The block hash to find in the archive tree.
+   * @returns The membership witness containing the leaf index and sibling path
    */
-  public utilityGetMembershipWitness(blockHash: L2BlockHash, treeId: MerkleTreeId, leafValue: Fr): Promise<Fr[]> {
-    const treeMembershipService = new TreeMembershipService(this.aztecNode);
-    return treeMembershipService.getMembershipWitness(blockHash, treeId, leafValue);
+  public utilityGetBlockHashMembershipWitness(
+    anchorBlockHash: BlockHash,
+    blockHash: BlockHash,
+  ): Promise<MembershipWitness<typeof ARCHIVE_HEIGHT> | undefined> {
+    return this.aztecNode.getBlockHashMembershipWitness(anchorBlockHash, blockHash);
   }
 
   /**
@@ -111,11 +181,11 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
    * @param nullifier - Nullifier we try to find witness for.
    * @returns The nullifier membership witness (if found).
    */
-  public async utilityGetNullifierMembershipWitness(
-    blockHash: L2BlockHash,
+  public utilityGetNullifierMembershipWitness(
+    blockHash: BlockHash,
     nullifier: Fr,
   ): Promise<NullifierMembershipWitness | undefined> {
-    return await this.aztecNode.getNullifierMembershipWitness(blockHash, nullifier);
+    return this.aztecNode.getNullifierMembershipWitness(blockHash, nullifier);
   }
 
   /**
@@ -127,12 +197,11 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
    * list structure" of leaves and proving that a lower nullifier is pointing to a bigger next value than the nullifier
    * we are trying to prove non-inclusion for.
    */
-  public async utilityGetLowNullifierMembershipWitness(
-    blockHash: L2BlockHash,
+  public utilityGetLowNullifierMembershipWitness(
+    blockHash: BlockHash,
     nullifier: Fr,
   ): Promise<NullifierMembershipWitness | undefined> {
-    const treeMembershipService = new TreeMembershipService(this.aztecNode);
-    return await treeMembershipService.getLowNullifierMembershipWitness(blockHash, nullifier);
+    return this.aztecNode.getLowNullifierMembershipWitness(blockHash, nullifier);
   }
 
   /**
@@ -141,12 +210,8 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
    * @param leafSlot - The slot of the public data tree to get the witness for.
    * @returns - The witness
    */
-  public async utilityGetPublicDataWitness(
-    blockHash: L2BlockHash,
-    leafSlot: Fr,
-  ): Promise<PublicDataWitness | undefined> {
-    const treeMembershipService = new TreeMembershipService(this.aztecNode);
-    return await treeMembershipService.getPublicDataWitness(blockHash, leafSlot);
+  public utilityGetPublicDataWitness(blockHash: BlockHash, leafSlot: Fr): Promise<PublicDataWitness | undefined> {
+    return this.aztecNode.getPublicDataWitness(blockHash, leafSlot);
   }
 
   /**
@@ -155,7 +220,7 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
    * @returns Block extracted from a block with block number `blockNumber`.
    */
   public async utilityGetBlockHeader(blockNumber: BlockNumber): Promise<BlockHeader | undefined> {
-    const anchorBlockNumber = (await this.anchorBlockStore.getBlockHeader()).getBlockNumber();
+    const anchorBlockNumber = this.anchorBlockHeader.getBlockNumber();
     if (blockNumber > anchorBlockNumber) {
       throw new Error(`Block number ${blockNumber} is higher than current block ${anchorBlockNumber}`);
     }
@@ -167,14 +232,13 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
   /**
    * Retrieve the complete address associated to a given address.
    * @param account - The account address.
-   * @returns A complete address associated with the input address.
-   * @throws An error if the account is not registered in the database.
+   * @returns A complete address associated with the input address, or `undefined` if not registered.
    */
-  public utilityGetPublicKeysAndPartialAddress(account: AztecAddress): Promise<CompleteAddress> {
-    return this.getCompleteAddress(account);
+  public utilityTryGetPublicKeysAndPartialAddress(account: AztecAddress): Promise<CompleteAddress | undefined> {
+    return this.addressStore.getCompleteAddress(account);
   }
 
-  protected async getCompleteAddress(account: AztecAddress): Promise<CompleteAddress> {
+  protected async getCompleteAddressOrFail(account: AztecAddress): Promise<CompleteAddress> {
     const completeAddress = await this.addressStore.getCompleteAddress(account);
     if (!completeAddress) {
       throw new Error(
@@ -251,7 +315,7 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
     offset: number,
     status: NoteStatus,
   ): Promise<NoteData[]> {
-    const noteService = new NoteService(this.noteStore, this.aztecNode, this.anchorBlockStore);
+    const noteService = new NoteService(this.noteStore, this.aztecNode, this.anchorBlockHeader, this.jobId);
 
     const dbNotes = await noteService.getNotes(this.contractAddress, owner, storageSlot, status, this.scopes);
     return pickNotes<NoteData>(dbNotes, {
@@ -275,10 +339,14 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
    * @returns A boolean indicating whether the nullifier exists in the tree or not.
    */
   public async utilityCheckNullifierExists(innerNullifier: Fr) {
-    const nullifier = await siloNullifier(this.contractAddress, innerNullifier!);
-    const treeMembershipService = new TreeMembershipService(this.aztecNode);
-    const index = await treeMembershipService.getNullifierIndex(nullifier);
-    return index !== undefined;
+    const [nullifier, anchorBlockHash] = await Promise.all([
+      siloNullifier(this.contractAddress, innerNullifier!),
+      this.anchorBlockHeader.hash(),
+    ]);
+    const [leafIndex] = await this.aztecNode.findLeavesIndexes(anchorBlockHash, MerkleTreeId.NULLIFIER_TREE, [
+      nullifier,
+    ]);
+    return leafIndex?.data !== undefined;
   }
 
   /**
@@ -290,14 +358,13 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
    * @returns The l1 to l2 membership witness (index of message in the tree and sibling path).
    */
   public async utilityGetL1ToL2MembershipWitness(contractAddress: AztecAddress, messageHash: Fr, secret: Fr) {
-    const treeMembershipService = new TreeMembershipService(this.aztecNode);
-    const [messageIndex, siblingPath] = await treeMembershipService.getL1ToL2MembershipWitness(
+    const [messageIndex, siblingPath] = await getNonNullifiedL1ToL2MessageWitness(
+      this.aztecNode,
       contractAddress,
       messageHash,
       secret,
     );
 
-    // Assuming messageIndex is what you intended to use for the index in MessageLoadOracleInputs
     return new MessageLoadOracleInputs(messageIndex, siblingPath);
   }
 
@@ -309,57 +376,64 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
    * @param numberOfElements - Number of elements to read from the starting storage slot.
    */
   public async utilityStorageRead(
-    blockHash: L2BlockHash,
+    blockHash: BlockHash,
     contractAddress: AztecAddress,
     startStorageSlot: Fr,
     numberOfElements: number,
   ) {
-    const values = [];
+    const slots = Array(numberOfElements)
+      .fill(0)
+      .map((_, i) => new Fr(startStorageSlot.value + BigInt(i)));
 
-    // TODO: why do we serialize these requests? This should probably a single call
-    // Privacy considerations?
-    for (let i = 0n; i < numberOfElements; i++) {
-      const storageSlot = new Fr(startStorageSlot.value + i);
-      const value = await this.aztecNode.getPublicStorageAt(blockHash, contractAddress, storageSlot);
+    const values = await Promise.all(
+      slots.map(storageSlot => this.aztecNode.getPublicStorageAt(blockHash, contractAddress, storageSlot)),
+    );
+
+    this.log.debug(
+      `Oracle storage read: slots=[${slots.map(slot => slot.toString()).join(', ')}] address=${contractAddress.toString()} values=[${values.join(', ')}]`,
+    );
 
-      this.log.debug(
-        `Oracle storage read: slot=${storageSlot.toString()} address-${contractAddress.toString()} value=${value}`,
-      );
-      values.push(value);
-    }
     return values;
   }
 
-  public utilityDebugLog(level: number, message: string, fields: Fr[]): void {
+  /**
+   * Returns a per-contract logger whose output is prefixed with `contract_log::<name>(<addrAbbrev>)`.
+   */
+  async #getContractLogger(): Promise<Logger> {
+    if (!this.contractLogger) {
+      const addrAbbrev = this.contractAddress.toString().slice(0, 10);
+      const name = await this.contractStore.getDebugContractName(this.contractAddress);
+      const module = name ? `contract_log::${name}(${addrAbbrev})` : `contract_log::${addrAbbrev}`;
+      // Purpose of instanceId is to distinguish logs from different instances of the same component. It makes sense
+      // to re-use jobId as instanceId here as executions of different PXE jobs are isolated.
+      this.contractLogger = createLogger(module, { instanceId: this.jobId });
+    }
+    return this.contractLogger;
+  }
+
+  public async utilityLog(level: number, message: string, fields: Fr[]): Promise<void> {
     if (!LogLevels[level]) {
-      throw new Error(`Invalid debug log level: ${level}`);
+      throw new Error(`Invalid log level: ${level}`);
     }
     const levelName = LogLevels[level];
-    this.aztecNrDebugLog[levelName](`${applyStringFormatting(message, fields)}`);
+    const logger = await this.#getContractLogger();
+    logger[levelName](`${applyStringFormatting(message, fields)}`);
   }
 
   public async utilityFetchTaggedLogs(pendingTaggedLogArrayBaseSlot: Fr) {
     const logService = new LogService(
       this.aztecNode,
-      this.anchorBlockStore,
+      this.anchorBlockHeader,
       this.keyStore,
       this.capsuleStore,
       this.recipientTaggingStore,
       this.senderAddressBookStore,
       this.addressStore,
       this.jobId,
+      this.log.getBindings(),
     );
 
-    const noteService = new NoteService(this.noteStore, this.aztecNode, this.anchorBlockStore);
-
-    // It is acceptable to run the following operations in parallel for several reasons:
-    // 1. syncTaggedLogs does not write to the note store — it only stores the pending tagged logs in a capsule array,
-    //    which is then processed in Noir after this handler returns.
-    // 2. Even if syncTaggedLogs did write to the note store, it would not cause inconsistent state.
-    await Promise.all([
-      logService.syncTaggedLogs(this.contractAddress, pendingTaggedLogArrayBaseSlot, this.scopes),
-      noteService.syncNoteNullifiers(this.contractAddress),
-    ]);
+    await logService.fetchTaggedLogs(this.contractAddress, pendingTaggedLogArrayBaseSlot, this.scopes);
   }
 
   /**
@@ -372,7 +446,7 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
    * @param noteValidationRequestsArrayBaseSlot - The base slot of capsule array containing note validation requests.
    * @param eventValidationRequestsArrayBaseSlot - The base slot of capsule array containing event validation requests.
    */
-  public async utilityValidateEnqueuedNotesAndEvents(
+  public async utilityValidateAndStoreEnqueuedNotesAndEvents(
     contractAddress: AztecAddress,
     noteValidationRequestsArrayBaseSlot: Fr,
     eventValidationRequestsArrayBaseSlot: Fr,
@@ -392,9 +466,9 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
       await this.capsuleStore.readCapsuleArray(contractAddress, eventValidationRequestsArrayBaseSlot, this.jobId)
     ).map(EventValidationRequest.fromFields);
 
-    const noteService = new NoteService(this.noteStore, this.aztecNode, this.anchorBlockStore);
+    const noteService = new NoteService(this.noteStore, this.aztecNode, this.anchorBlockHeader, this.jobId);
     const noteStorePromises = noteValidationRequests.map(request =>
-      noteService.storeNote(
+      noteService.validateAndStoreNote(
         request.contractAddress,
         request.owner,
         request.storageSlot,
@@ -408,9 +482,9 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
       ),
     );
 
-    const eventService = new EventService(this.anchorBlockStore, this.aztecNode, this.privateEventStore, this.jobId);
+    const eventService = new EventService(this.anchorBlockHeader, this.aztecNode, this.privateEventStore, this.jobId);
     const eventStorePromises = eventValidationRequests.map(request =>
-      eventService.storeEvent(
+      eventService.validateAndStoreEvent(
         request.contractAddress,
         request.eventTypeId,
         request.randomness,
@@ -446,13 +520,14 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
 
     const logService = new LogService(
       this.aztecNode,
-      this.anchorBlockStore,
+      this.anchorBlockHeader,
       this.keyStore,
       this.capsuleStore,
       this.recipientTaggingStore,
       this.senderAddressBookStore,
       this.addressStore,
       this.jobId,
+      this.log.getBindings(),
     );
 
     const maybeLogRetrievalResponses = await logService.bulkRetrieveLogs(logRetrievalRequests);
@@ -530,7 +605,7 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
 
   protected async getSharedSecret(address: AztecAddress, ephPk: Point): Promise<Point> {
     // TODO(#12656): return an app-siloed secret
-    const recipientCompleteAddress = await this.getCompleteAddress(address);
+    const recipientCompleteAddress = await this.getCompleteAddressOrFail(address);
     const ivskM = await this.keyStore.getMasterSecretKey(
       recipientCompleteAddress.publicKeys.masterIncomingViewingPublicKey,
     );

package/src/contract_sync/contract_sync_service.ts

@@ -0,0 +1,145 @@
+import type { Logger } from '@aztec/foundation/log';
+import type { FunctionCall, FunctionSelector } from '@aztec/stdlib/abi';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+import type { AztecNode } from '@aztec/stdlib/interfaces/client';
+import type { BlockHeader } from '@aztec/stdlib/tx';
+
+import type { StagedStore } from '../job_coordinator/job_coordinator.js';
+import type { ContractStore } from '../storage/contract_store/contract_store.js';
+import type { NoteStore } from '../storage/note_store/note_store.js';
+import { syncState, verifyCurrentClassId } from './helpers.js';
+
+/**
+ * Service for syncing the private state of contracts and verifying that the PXE holds the current class artifact.
+ * It uses a cache to avoid redundant sync operations - the cache is wiped when the anchor block changes.
+ *
+ * TODO: The StagedStore naming is broken here. Figure out a better name.
+ */
+export class ContractSyncService implements StagedStore {
+  readonly storeName = 'contract_sync';
+
+  // Tracks contracts synced since last wipe. The cache is keyed per individual scope address
+  // (`contractAddress:scopeAddress`), or `contractAddress:*` for undefined scopes (all accounts).
+  // The value is a promise that resolves when the contract is synced.
+  private syncedContracts: Map<string, Promise<void>> = new Map();
+
+  // Per-job overridden contract addresses - these contracts should not be synced.
+  private overriddenContracts: Map<string, Set<string>> = new Map();
+
+  constructor(
+    private aztecNode: AztecNode,
+    private contractStore: ContractStore,
+    private noteStore: NoteStore,
+    private log: Logger,
+  ) {}
+
+  /** Sets contracts that should be skipped during sync for a specific job. */
+  setOverriddenContracts(jobId: string, addresses: Set<string>): void {
+    this.overriddenContracts.set(jobId, addresses);
+  }
+
+  /**
+   * Ensures a contract's private state is synchronized and that the PXE holds the current class artifact.
+   * Uses a cache to avoid redundant sync operations - the cache is wiped when the anchor block changes.
+   * @param contractAddress - The address of the contract to sync.
+   * @param functionToInvokeAfterSync - The function selector that will be called after sync (used to validate it's
+   * not sync_state itself).
+   * @param utilityExecutor - Executor function for running the sync_state utility function.
+   * @param scopes - Scopes to pass through to the utility executor (affects which notes are discovered).
+   */
+  async ensureContractSynced(
+    contractAddress: AztecAddress,
+    functionToInvokeAfterSync: FunctionSelector | null,
+    utilityExecutor: (call: FunctionCall, scopes: undefined | AztecAddress[]) => Promise<any>,
+    anchorBlockHeader: BlockHeader,
+    jobId: string,
+    scopes: undefined | AztecAddress[],
+  ): Promise<void> {
+    // Skip sync if this contract has an override for this job (overrides are keyed by contract address only)
+    const overrides = this.overriddenContracts.get(jobId);
+    if (overrides?.has(contractAddress.toString())) {
+      return;
+    }
+
+    // Skip sync if we already synced for "all scopes", or if we have an empty list of scopes
+    const allScopesKey = toKey(contractAddress, undefined);
+    const allScopesExisting = this.syncedContracts.get(allScopesKey);
+    if (allScopesExisting || (scopes && scopes.length == 0)) {
+      return;
+    }
+
+    const unsyncedScopes = scopes?.filter(scope => !this.syncedContracts.has(toKey(contractAddress, scope)));
+    const unsyncedScopesKeys = toKeys(contractAddress, unsyncedScopes);
+
+    if (unsyncedScopesKeys.length > 0) {
+      // Start sync and store the promise for all unsynced scopes
+      const promise = this.#doSync(
+        contractAddress,
+        functionToInvokeAfterSync,
+        call => utilityExecutor(call, unsyncedScopes),
+        anchorBlockHeader,
+        jobId,
+      ).catch(err => {
+        // There was an error syncing the contract, so we remove it from the cache so that it can be retried.
+        unsyncedScopesKeys.forEach(key => this.syncedContracts.delete(key));
+        throw err;
+      });
+      unsyncedScopesKeys.forEach(key => this.syncedContracts.set(key, promise));
+    }
+
+    const promises = toKeys(contractAddress, scopes).map(key => this.syncedContracts.get(key)!);
+    await Promise.all(promises);
+  }
+
+  async #doSync(
+    contractAddress: AztecAddress,
+    functionToInvokeAfterSync: FunctionSelector | null,
+    utilityExecutor: (call: FunctionCall) => Promise<any>,
+    anchorBlockHeader: BlockHeader,
+    jobId: string,
+  ): Promise<void> {
+    this.log.debug(`Syncing contract ${contractAddress}`);
+    await Promise.all([
+      syncState(
+        contractAddress,
+        this.contractStore,
+        functionToInvokeAfterSync,
+        utilityExecutor,
+        this.noteStore,
+        this.aztecNode,
+        anchorBlockHeader,
+        jobId,
+      ),
+      verifyCurrentClassId(contractAddress, this.aztecNode, this.contractStore, anchorBlockHeader),
+    ]);
+    this.log.debug(`Contract ${contractAddress} synced`);
+  }
+
+  /** Clears sync cache. Called by BlockSynchronizer when anchor block changes. */
+  wipe(): void {
+    this.log.debug(`Wiping contract sync cache (${this.syncedContracts.size} entries)`);
+    this.syncedContracts.clear();
+  }
+
+  commit(jobId: string): Promise<void> {
+    // Clear overridden contracts for this job
+    this.overriddenContracts.delete(jobId);
+    return Promise.resolve();
+  }
+
+  discardStaged(jobId: string): Promise<void> {
+    // We clear the synced contracts cache here because, when the job is discarded, any associated database writes from
+    // the sync are also undone.
+    this.syncedContracts.clear();
+    this.overriddenContracts.delete(jobId);
+    return Promise.resolve();
+  }
+}
+
+function toKeys(contract: AztecAddress, scopes: undefined | AztecAddress[]) {
+  return scopes === undefined ? [toKey(contract, undefined)] : scopes.map(scope => toKey(contract, scope));
+}
+
+function toKey(contract: AztecAddress, scope: AztecAddress | undefined) {
+  return scope === undefined ? `${contract.toString()}:*` : `${contract.toString()}:${scope.toString()}`;
+}