@aztec/pxe 0.0.1-commit.ee80a48 → 0.0.1-commit.f103f88

package/dest/pxe.js

@@ -13,11 +13,14 @@ import { BlockSynchronizer } from './block_synchronizer/index.js';
 import { BenchmarkedNodeFactory } from './contract_function_simulator/benchmarked_node.js';
 import { ContractFunctionSimulator, generateSimulatedProvingResult } from './contract_function_simulator/contract_function_simulator.js';
 import { ProxiedContractStoreFactory } from './contract_function_simulator/proxied_contract_data_source.js';
-import { ensureContractSynced, readCurrentClassId } from './contract_sync/index.js';
+import { displayDebugLogs } from './contract_logging.js';
+import { ContractSyncService } from './contract_sync/contract_sync_service.js';
+import { readCurrentClassId } from './contract_sync/helpers.js';
 import { PXEDebugUtils } from './debug/pxe_debug_utils.js';
 import { enrichPublicSimulationError, enrichSimulationError } from './error_enriching.js';
 import { PrivateEventFilterValidator } from './events/private_event_filter_validator.js';
 import { JobCoordinator } from './job_coordinator/job_coordinator.js';
+import { MessageContextService } from './messages/message_context_service.js';
 import { PrivateKernelExecutionProver } from './private_kernel/private_kernel_execution_prover.js';
 import { PrivateKernelOracle } from './private_kernel/private_kernel_oracle.js';
 import { AddressStore } from './storage/address_store/address_store.js';
@@ -34,6 +37,7 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
  * manage private state of users.
  */ export class PXE {
     node;
+    db;
     blockStateSynchronizer;
     keyStore;
     contractStore;
@@ -45,6 +49,9 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
     recipientTaggingStore;
     addressStore;
     privateEventStore;
+    contractSyncService;
+    messageContextService;
+    l2TipsStore;
     simulator;
     proverEnabled;
     proofCreator;
@@ -53,8 +60,9 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
     jobQueue;
     jobCoordinator;
     debug;
-    constructor(node, blockStateSynchronizer, keyStore, contractStore, noteStore, capsuleStore, anchorBlockStore, senderTaggingStore, senderAddressBookStore, recipientTaggingStore, addressStore, privateEventStore, simulator, proverEnabled, proofCreator, protocolContractsProvider, log, jobQueue, jobCoordinator, debug){
+    constructor(node, db, blockStateSynchronizer, keyStore, contractStore, noteStore, capsuleStore, anchorBlockStore, senderTaggingStore, senderAddressBookStore, recipientTaggingStore, addressStore, privateEventStore, contractSyncService, messageContextService, l2TipsStore, simulator, proverEnabled, proofCreator, protocolContractsProvider, log, jobQueue, jobCoordinator, debug){
         this.node = node;
+        this.db = db;
         this.blockStateSynchronizer = blockStateSynchronizer;
         this.keyStore = keyStore;
         this.contractStore = contractStore;
@@ -66,6 +74,9 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
         this.recipientTaggingStore = recipientTaggingStore;
         this.addressStore = addressStore;
         this.privateEventStore = privateEventStore;
+        this.contractSyncService = contractSyncService;
+        this.messageContextService = messageContextService;
+        this.l2TipsStore = l2TipsStore;
         this.simulator = simulator;
         this.proverEnabled = proverEnabled;
         this.proofCreator = proofCreator;
@@ -81,11 +92,12 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
    * can be contacted.
    *
    * @returns A promise that resolves PXE is ready to be used.
-   */ static async create(node, store, proofCreator, simulator, protocolContractsProvider, config, loggerOrSuffix) {
+   */ static async create({ node, store, proofCreator, simulator, protocolContractsProvider, config, loggerOrSuffix }) {
         // Extract bindings from the logger, or use empty bindings if a string suffix is provided.
         const bindings = loggerOrSuffix && typeof loggerOrSuffix !== 'string' ? loggerOrSuffix.getBindings() : undefined;
         const log = !loggerOrSuffix || typeof loggerOrSuffix === 'string' ? createLogger(loggerOrSuffix ? `pxe:service:${loggerOrSuffix}` : `pxe:service`) : loggerOrSuffix;
-        const proverEnabled = !!config.proverEnabled;
+        const info = await node.getNodeInfo();
+        const proverEnabled = config.proverEnabled !== undefined ? config.proverEnabled : info.realProofs;
         const addressStore = new AddressStore(store);
         const privateEventStore = new PrivateEventStore(store);
         const contractStore = new ContractStore(store);
@@ -97,29 +109,46 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
         const capsuleStore = new CapsuleStore(store);
         const keyStore = new KeyStore(store);
         const tipsStore = new L2TipsKVStore(store, 'pxe');
-        const synchronizer = new BlockSynchronizer(node, store, anchorBlockStore, noteStore, privateEventStore, tipsStore, config, bindings);
+        const contractSyncService = new ContractSyncService(node, contractStore, noteStore, createLogger('pxe:contract_sync', bindings));
+        const messageContextService = new MessageContextService(node);
+        const synchronizer = new BlockSynchronizer(node, store, anchorBlockStore, noteStore, privateEventStore, tipsStore, contractSyncService, config, bindings);
         const jobCoordinator = new JobCoordinator(store, bindings);
         jobCoordinator.registerStores([
             capsuleStore,
             senderTaggingStore,
             recipientTaggingStore,
             privateEventStore,
-            noteStore
+            noteStore,
+            contractSyncService
         ]);
-        const debugUtils = new PXEDebugUtils(contractStore, noteStore, synchronizer, anchorBlockStore);
+        const debugUtils = new PXEDebugUtils(contractSyncService, noteStore, synchronizer, anchorBlockStore);
         const jobQueue = new SerialQueue();
-        const pxe = new PXE(node, synchronizer, keyStore, contractStore, noteStore, capsuleStore, anchorBlockStore, senderTaggingStore, senderAddressBookStore, recipientTaggingStore, addressStore, privateEventStore, simulator, proverEnabled, proofCreator, protocolContractsProvider, log, jobQueue, jobCoordinator, debugUtils);
-        debugUtils.setPXE(pxe, pxe.#putInJobQueue.bind(pxe));
+        const pxe = new PXE(node, store, synchronizer, keyStore, contractStore, noteStore, capsuleStore, anchorBlockStore, senderTaggingStore, senderAddressBookStore, recipientTaggingStore, addressStore, privateEventStore, contractSyncService, messageContextService, tipsStore, simulator, proverEnabled, proofCreator, protocolContractsProvider, log, jobQueue, jobCoordinator, debugUtils);
+        debugUtils.setPXEHelpers(pxe.#putInJobQueue.bind(pxe), pxe.#getSimulatorForTx.bind(pxe), pxe.#executeUtility.bind(pxe));
         pxe.jobQueue.start();
         await pxe.#registerProtocolContracts();
-        const info = await node.getNodeInfo();
         log.info(`Started PXE connected to chain ${info.l1ChainId} version ${info.rollupVersion}`);
         return pxe;
     }
     // Internal methods
     #getSimulatorForTx(overrides) {
         const proxyContractStore = ProxiedContractStoreFactory.create(this.contractStore, overrides?.contracts);
-        return new ContractFunctionSimulator(proxyContractStore, this.noteStore, this.keyStore, this.addressStore, BenchmarkedNodeFactory.create(this.node), this.senderTaggingStore, this.recipientTaggingStore, this.senderAddressBookStore, this.capsuleStore, this.privateEventStore, this.simulator);
+        return new ContractFunctionSimulator({
+            contractStore: proxyContractStore,
+            noteStore: this.noteStore,
+            keyStore: this.keyStore,
+            addressStore: this.addressStore,
+            aztecNode: BenchmarkedNodeFactory.create(this.node),
+            l2TipsStore: this.l2TipsStore,
+            senderTaggingStore: this.senderTaggingStore,
+            recipientTaggingStore: this.recipientTaggingStore,
+            senderAddressBookStore: this.senderAddressBookStore,
+            capsuleStore: this.capsuleStore,
+            privateEventStore: this.privateEventStore,
+            simulator: this.simulator,
+            contractSyncService: this.contractSyncService,
+            messageContextService: this.messageContextService
+        });
     }
     #contextualizeError(err, ...context) {
         let contextStr = '';
@@ -162,8 +191,8 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
     async #registerProtocolContracts() {
         const registered = {};
         for (const name of protocolContractNames){
-            const { address, contractClass, instance, artifact } = await this.protocolContractsProvider.getProtocolContractArtifact(name);
-            await this.contractStore.addContractArtifact(contractClass.id, artifact);
+            const { address, instance, artifact } = await this.protocolContractsProvider.getProtocolContractArtifact(name);
+            await this.contractStore.addContractArtifact(artifact);
             await this.contractStore.addContractInstance(instance);
             registered[name] = address.toString();
         }
@@ -175,10 +204,14 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
         const { origin: contractAddress, functionSelector } = txRequest;
         try {
             const anchorBlockHeader = await this.anchorBlockStore.getBlockHeader();
-            await ensureContractSynced(contractAddress, functionSelector, (privateSyncCall)=>this.#simulateUtility(contractFunctionSimulator, privateSyncCall, [], undefined, jobId), this.node, this.contractStore, this.noteStore, anchorBlockHeader, jobId);
-            const result = await contractFunctionSimulator.run(txRequest, contractAddress, functionSelector, undefined, anchorBlockHeader, // The sender for tags is set by contracts, typically by an account
-            // contract entrypoint
-            undefined, scopes, jobId);
+            await this.contractSyncService.ensureContractSynced(contractAddress, functionSelector, (privateSyncCall, execScopes)=>this.#executeUtility(contractFunctionSimulator, privateSyncCall, [], execScopes, jobId), anchorBlockHeader, jobId, scopes);
+            const result = await contractFunctionSimulator.run(txRequest, {
+                contractAddress,
+                selector: functionSelector,
+                anchorBlockHeader,
+                scopes,
+                jobId
+            });
             this.log.debug(`Private simulation completed for ${contractAddress.toString()}:${functionSelector}`);
             return result;
         } catch (err) {
@@ -189,18 +222,22 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
         }
     }
     /**
-   * Simulate a utility function call on the given contract.
+   * Execute a utility function call on the given contract.
    * @param contractFunctionSimulator - The simulator to use for the function call.
    * @param call - The function call to execute.
    * @param authWitnesses - Authentication witnesses required for the function call.
    * @param scopes - Optional array of account addresses whose notes can be accessed in this call. Defaults to all
    * accounts if not specified.
    * @param jobId - The job ID for staged writes.
-   * @returns The simulation result containing the outputs of the utility function.
-   */ async #simulateUtility(contractFunctionSimulator, call, authWitnesses, scopes, jobId) {
+   * @returns The execution result containing the outputs of the utility function.
+   */ async #executeUtility(contractFunctionSimulator, call, authWitnesses, scopes, jobId) {
         try {
             const anchorBlockHeader = await this.anchorBlockStore.getBlockHeader();
-            return contractFunctionSimulator.runUtility(call, authWitnesses ?? [], anchorBlockHeader, scopes, jobId);
+            const { result, offchainEffects } = await contractFunctionSimulator.runUtility(call, authWitnesses ?? [], anchorBlockHeader, scopes, jobId);
+            return {
+                result,
+                offchainEffects
+            };
         } catch (err) {
             if (err instanceof SimulationError) {
                 await enrichSimulationError(err, this.contractStore, this.log);
@@ -252,7 +289,19 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
         return await kernelTraceProver.proveWithKernels(txExecutionRequest.toTxRequest(), privateExecutionResult, config);
     }
     // Public API
-    getContractInstance(address) {
+    /**
+   * Returns the block header up to which the PXE has synced.
+   * @returns The synced block header
+   */ getSyncedBlockHeader() {
+        return this.#putInJobQueue(()=>{
+            return this.anchorBlockStore.getBlockHeader();
+        });
+    }
+    /**
+   * Returns the contract instance for a given address, if it's registered in the PXE.
+   * @param address - The contract address.
+   * @returns The contract instance if found, undefined otherwise.
+   */ getContractInstance(address) {
         return this.contractStore.getContractInstance(address);
     }
     /**
@@ -294,6 +343,9 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
    * @returns The address of the sender.
    * TODO: It's strange that we return the address here and I (benesjan) think we should drop the return value.
    */ async registerSender(sender) {
+        if (!await sender.isValid()) {
+            throw new Error(`Address ${sender} is not valid: it does not correspond to a point on the Grumpkin curve. Cannot register it as a sender.`);
+        }
         const accounts = await this.keyStore.getAccounts();
         if (accounts.includes(sender)) {
             this.log.info(`Sender:\n "${sender.toString()}"\n already registered.`);
@@ -302,6 +354,9 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
         const wasAdded = await this.senderAddressBookStore.addSender(sender);
         if (wasAdded) {
             this.log.info(`Added sender:\n ${sender.toString()}`);
+            // Wipe the entire sync cache: the new sender's tagged logs could contain notes/events for any contract, so
+            // all contracts must re-sync to discover them.
+            this.contractSyncService.wipe();
         } else {
             this.log.info(`Sender:\n "${sender.toString()}"\n already registered.`);
         }
@@ -339,8 +394,7 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
    *
    * @param artifact - The build artifact for the contract class.
    */ async registerContractClass(artifact) {
-        const { id: contractClassId } = await getContractClassFromArtifact(artifact);
-        await this.contractStore.addContractArtifact(contractClassId, artifact);
+        const contractClassId = await this.contractStore.addContractArtifact(artifact);
         this.log.info(`Added contract class ${artifact.name} with id ${contractClassId}`);
     }
     /**
@@ -356,15 +410,14 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
         if (artifact) {
             // If the user provides an artifact, validate it against the expected class id and register it
             const contractClass = await getContractClassFromArtifact(artifact);
-            const contractClassId = contractClass.id;
-            if (!contractClassId.equals(instance.currentContractClassId)) {
-                throw new Error(`Artifact does not match expected class id (computed ${contractClassId} but instance refers to ${instance.currentContractClassId})`);
+            if (!contractClass.id.equals(instance.currentContractClassId)) {
+                throw new Error(`Artifact does not match expected class id (computed ${contractClass.id} but instance refers to ${instance.currentContractClassId})`);
             }
             const computedAddress = await computeContractAddressFromInstance(instance);
             if (!computedAddress.equals(instance.address)) {
                 throw new Error('Added a contract in which the address does not match the contract instance.');
             }
-            await this.contractStore.addContractArtifact(contractClass.id, artifact);
+            await this.contractStore.addContractArtifact(artifact, contractClass);
             const publicFunctionSignatures = artifact.functions.filter((fn)=>fn.functionType === FunctionType.PUBLIC).map((fn)=>decodeFunctionSignature(fn.name, fn.parameters));
             await this.node.registerContractFunctionSignatures(publicFunctionSignatures);
         } else {
@@ -400,11 +453,13 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
             if (!contractClass.id.equals(currentClassId)) {
                 throw new Error('Could not update contract to a class different from the current one.');
             }
-            await this.contractStore.addContractArtifact(contractClass.id, artifact);
             const publicFunctionSignatures = artifact.functions.filter((fn)=>fn.functionType === FunctionType.PUBLIC).map((fn)=>decodeFunctionSignature(fn.name, fn.parameters));
             await this.node.registerContractFunctionSignatures(publicFunctionSignatures);
             currentInstance.currentContractClassId = contractClass.id;
-            await this.contractStore.addContractInstance(currentInstance);
+            await Promise.all([
+                this.contractStore.addContractArtifact(artifact, contractClass),
+                this.contractStore.addContractInstance(currentInstance)
+            ]);
             this.log.info(`Updated contract ${artifact.name} at ${contractAddress.toString()} to class ${contractClass.id}`);
         });
     }
@@ -419,10 +474,11 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
    * (where validators prove the public portion).
    *
    * @param txRequest - An authenticated tx request ready for proving
+   * @param scopes - Addresses whose private state and keys are accessible during private execution.
    * @returns A result containing the proof and public inputs of the tail circuit.
    * @throws If contract code not found, or public simulation reverts.
    * Also throws if simulatePublic is true and public simulation reverts.
-   */ proveTx(txRequest) {
+   */ proveTx(txRequest, scopes) {
         let privateExecutionResult;
         // We disable proving concurrently mostly out of caution, since it accesses some of our stores. Proving is so
         // computationally demanding that it'd be rare for someone to try to do it concurrently regardless.
@@ -433,7 +489,7 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
                 await this.blockStateSynchronizer.sync();
                 const syncTime = syncTimer.ms();
                 const contractFunctionSimulator = this.#getSimulatorForTx();
-                privateExecutionResult = await this.#executePrivate(contractFunctionSimulator, txRequest, undefined, jobId);
+                privateExecutionResult = await this.#executePrivate(contractFunctionSimulator, txRequest, scopes, jobId);
                 const { publicInputs, chonkProof, executionSteps, timings: { proving } = {} } = await this.#prove(txRequest, this.proofCreator, privateExecutionResult, {
                     simulate: false,
                     skipFeeEnforcement: false,
@@ -464,16 +520,16 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
                 // transaction before this one is included in a block from this PXE, and that transaction contains a log with
                 // a tag derived from the same secret, we would reuse the tag and the transactions would be linked. Hence
                 // storing the tags here prevents linkage of txs sent from the same PXE.
-                const preTagsUsedInTheTx = privateExecutionResult.entrypoint.preTags;
-                if (preTagsUsedInTheTx.length > 0) {
+                const taggingIndexRangesUsedInTheTx = privateExecutionResult.entrypoint.taggingIndexRanges;
+                if (taggingIndexRangesUsedInTheTx.length > 0) {
                     // TODO(benesjan): The following is an expensive operation. Figure out a way to avoid it.
                     const txHash = (await txProvingResult.toTx()).txHash;
-                    await this.senderTaggingStore.storePendingIndexes(preTagsUsedInTheTx, txHash, jobId);
-                    this.log.debug(`Stored used pre-tags as sender for the tx`, {
-                        preTagsUsedInTheTx
+                    await this.senderTaggingStore.storePendingIndexes(taggingIndexRangesUsedInTheTx, txHash, jobId);
+                    this.log.debug(`Stored used tagging index ranges as sender for the tx`, {
+                        taggingIndexRangesUsedInTheTx
                     });
                 } else {
-                    this.log.debug(`No pre-tags used in the tx`);
+                    this.log.debug(`No tagging index ranges used in the tx`);
                 }
                 return txProvingResult;
             } catch (err) {
@@ -483,13 +539,10 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
     }
     /**
    * Profiles a transaction, reporting gate counts (unless disabled) and returns an execution trace.
-   *
-   * @param txRequest - An authenticated tx request ready for simulation
-   * @param msgSender - (Optional) The message sender to use for the simulation.
-   * @param skipTxValidation - (Optional) If false, this function throws if the transaction is unable to be included in a block at the current state.
+   * @param txRequest - An authenticated tx request ready for simulation.
    * @returns A trace of the program execution with gate counts.
    * @throws If the code for the functions executed in this transaction have not been made available via `addContracts`.
-   */ profileTx(txRequest, profileMode, skipProofGeneration = true) {
+   */ profileTx(txRequest, { profileMode, skipProofGeneration = true, scopes }) {
         // We disable concurrent profiles for consistency with simulateTx.
         return this.#putInJobQueue(async (jobId)=>{
             const totalTimer = new Timer();
@@ -507,7 +560,7 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
                 await this.blockStateSynchronizer.sync();
                 const syncTime = syncTimer.ms();
                 const contractFunctionSimulator = this.#getSimulatorForTx();
-                const privateExecutionResult = await this.#executePrivate(contractFunctionSimulator, txRequest, undefined, jobId);
+                const privateExecutionResult = await this.#executePrivate(contractFunctionSimulator, txRequest, scopes, jobId);
                 const { executionSteps, timings: { proving } = {} } = await this.#prove(txRequest, this.proofCreator, privateExecutionResult, {
                     simulate: skipProofGeneration,
                     skipFeeEnforcement: false,
@@ -552,18 +605,13 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
    * In that case, the transaction returned is only potentially ready to be sent to the network for execution.
    *
    *
-   * @param txRequest - An authenticated tx request ready for simulation
-   * @param simulatePublic - Whether to simulate the public part of the transaction.
-   * @param skipTxValidation - (Optional) If false, this function throws if the transaction is unable to be included in a block at the current state.
-   * @param skipFeeEnforcement - (Optional) If false, fees are enforced.
-   * @param overrides - (Optional) State overrides for the simulation, such as msgSender, contract instances and artifacts.
-   * @param scopes - (Optional) The accounts whose notes we can access in this call. Currently optional and will default to all.
+   * @param txRequest - An authenticated tx request ready for simulation.
    * @returns A simulated transaction result object that includes public and private return values.
    * @throws If the code for the functions executed in this transaction have not been made available via `addContracts`.
    * Also throws if simulatePublic is true and public simulation reverts.
    *
    * TODO(#7456) Prevent msgSender being defined here for the first call
-   */ simulateTx(txRequest, simulatePublic, skipTxValidation = false, skipFeeEnforcement = false, overrides, scopes) {
+   */ simulateTx(txRequest, { simulatePublic, skipTxValidation = false, skipFeeEnforcement = false, skipKernels = true, overrides, scopes }) {
         // We disable concurrent simulations since those might execute oracles which read and write to the PXE stores (e.g.
         // to the capsules), and we need to prevent concurrent runs from interfering with one another (e.g. attempting to
         // delete the same read value, or reading values that another simulation is currently modifying).
@@ -582,17 +630,23 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
                 const syncTimer = new Timer();
                 await this.blockStateSynchronizer.sync();
                 const syncTime = syncTimer.ms();
+                const overriddenContracts = overrides?.contracts ? new Set(Object.keys(overrides.contracts)) : undefined;
+                const hasOverriddenContracts = overriddenContracts !== undefined && overriddenContracts.size > 0;
+                if (hasOverriddenContracts && !skipKernels) {
+                    throw new Error('Simulating with overridden contracts is not compatible with kernel execution. Please set skipKernels to true when simulating with overridden contracts.');
+                }
                 const contractFunctionSimulator = this.#getSimulatorForTx(overrides);
-                // Temporary: in case there are overrides, we have to skip the kernels or validations
-                // will fail. Consider handing control to the user/wallet on whether they want to run them
-                // or not.
-                const skipKernels = overrides?.contracts !== undefined && Object.keys(overrides.contracts ?? {}).length > 0;
+                if (hasOverriddenContracts) {
+                    // Overridden contracts don't have a sync function, so calling sync on them would fail.
+                    // We exclude them so the sync service skips them entirely.
+                    this.contractSyncService.setExcludedFromSync(jobId, overriddenContracts);
+                }
                 // Execution of private functions only; no proving, and no kernel logic.
                 const privateExecutionResult = await this.#executePrivate(contractFunctionSimulator, txRequest, scopes, jobId);
                 let publicInputs;
                 let executionSteps = [];
                 if (skipKernels) {
-                    ({ publicInputs, executionSteps } = await generateSimulatedProvingResult(privateExecutionResult, this.contractStore));
+                    ({ publicInputs, executionSteps } = await generateSimulatedProvingResult(privateExecutionResult, (addr, sel)=>this.contractStore.getDebugFunctionName(addr, sel), this.node));
                 } else {
                     // Kernel logic, plus proving of all private functions and kernels.
                     ({ publicInputs, executionSteps } = await this.#prove(txRequest, this.proofCreator, privateExecutionResult, {
@@ -609,6 +663,9 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
                     const publicSimulationTimer = new Timer();
                     publicOutput = await this.#simulatePublicCalls(simulatedTx, skipFeeEnforcement);
                     publicSimulationTime = publicSimulationTimer.ms();
+                    if (publicOutput?.debugLogs?.length) {
+                        await displayDebugLogs(publicOutput.debugLogs, (addr)=>this.contractStore.getDebugContractName(addr));
+                    }
                 }
                 let validationTime;
                 if (!skipTxValidation) {
@@ -619,7 +676,8 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
                     });
                     validationTime = validationTimer.ms();
                     if (validationResult.result === 'invalid') {
-                        throw new Error('The simulated transaction is unable to be added to state and is invalid.');
+                        const reason = validationResult.reason.length > 0 ? ` Reason: ${validationResult.reason.join(', ')}` : '';
+                        throw new Error(`The simulated transaction is unable to be added to state and is invalid.${reason}`);
                     }
                 }
                 const txHash = simulatedTx.getTxHash();
@@ -652,22 +710,19 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
                     nodeRPCCalls: simulatorStats.nodeRPCCalls
                 });
             } catch (err) {
-                throw this.#contextualizeError(err, inspect(txRequest), `simulatePublic=${simulatePublic}`, `skipTxValidation=${skipTxValidation}`, `scopes=${scopes?.map((s)=>s.toString()).join(', ') ?? 'undefined'}`);
+                throw this.#contextualizeError(err, inspect(txRequest), `simulatePublic=${simulatePublic}`, `skipTxValidation=${skipTxValidation}`, `scopes=${scopes.map((s)=>s.toString()).join(', ')}`);
             }
         });
     }
     /**
-   * Simulate the execution of a contract utility function.
-   *
+   * Executes a contract utility function.
    * @param call - The function call containing the function details, arguments, and target contract address.
-   * @param authwits - (Optional) The authentication witnesses required for the function call.
-   * @param scopes - (Optional) The accounts whose notes we can access in this call. Currently optional and will
-   * default to all.
-   * @returns The result of the utility function call, structured based on the function ABI.
-   */ simulateUtility(call, authwits, scopes) {
-        // We disable concurrent simulations since those might execute oracles which read and write to the PXE stores (e.g.
+   */ executeUtility(call, { authwits, scopes } = {
+        scopes: []
+    }) {
+        // We disable concurrent executions since those might execute oracles which read and write to the PXE stores (e.g.
         // to the capsules), and we need to prevent concurrent runs from interfering with one another (e.g. attempting to
-        // delete the same read value, or reading values that another simulation is currently modifying).
+        // delete the same read value, or reading values that another execution is currently modifying).
         return this.#putInJobQueue(async (jobId)=>{
             try {
                 const totalTimer = new Timer();
@@ -677,8 +732,8 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
                 const functionTimer = new Timer();
                 const contractFunctionSimulator = this.#getSimulatorForTx();
                 const anchorBlockHeader = await this.anchorBlockStore.getBlockHeader();
-                await ensureContractSynced(call.to, call.selector, (privateSyncCall)=>this.#simulateUtility(contractFunctionSimulator, privateSyncCall, [], undefined, jobId), this.node, this.contractStore, this.noteStore, anchorBlockHeader, jobId);
-                const executionResult = await this.#simulateUtility(contractFunctionSimulator, call, authwits ?? [], scopes, jobId);
+                await this.contractSyncService.ensureContractSynced(call.to, call.selector, (privateSyncCall, execScopes)=>this.#executeUtility(contractFunctionSimulator, privateSyncCall, [], execScopes, jobId), anchorBlockHeader, jobId, scopes);
+                const { result: executionResult, offchainEffects } = await this.#executeUtility(contractFunctionSimulator, call, authwits ?? [], scopes, jobId);
                 const functionTime = functionTimer.ms();
                 const totalTime = totalTimer.ms();
                 const perFunction = [
@@ -696,6 +751,8 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
                 const simulationStats = contractFunctionSimulator.getStats();
                 return {
                     result: executionResult,
+                    offchainEffects,
+                    anchorBlockTimestamp: anchorBlockHeader.globalVariables.timestamp,
                     stats: {
                         timings,
                         nodeRPCCalls: simulationStats.nodeRPCCalls
@@ -704,7 +761,7 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
             } catch (err) {
                 const { to, name, args } = call;
                 const stringifiedArgs = args.map((arg)=>arg.toString()).join(', ');
-                throw this.#contextualizeError(err, `simulateUtility ${to}:${name}(${stringifiedArgs})`, `scopes=${scopes?.map((s)=>s.toString()).join(', ') ?? 'undefined'}`);
+                throw this.#contextualizeError(err, `executeUtility ${to}:${name}(${stringifiedArgs})`, `scopes=${scopes.map((s)=>s.toString()).join(', ')}`);
             }
         });
     }
@@ -727,7 +784,7 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
             const anchorBlockHeader = await this.anchorBlockStore.getBlockHeader();
             anchorBlockNumber = anchorBlockHeader.getBlockNumber();
             const contractFunctionSimulator = this.#getSimulatorForTx();
-            await ensureContractSynced(filter.contractAddress, null, async (privateSyncCall)=>await this.#simulateUtility(contractFunctionSimulator, privateSyncCall, [], undefined, jobId), this.node, this.contractStore, this.noteStore, anchorBlockHeader, jobId);
+            await this.contractSyncService.ensureContractSynced(filter.contractAddress, null, async (privateSyncCall, execScopes)=>await this.#executeUtility(contractFunctionSimulator, privateSyncCall, [], execScopes, jobId), anchorBlockHeader, jobId, filter.scopes);
         });
         // anchorBlockNumber is set during the job and fixed to whatever it is after a block sync
         const sanitizedFilter = new PrivateEventFilterValidator(anchorBlockNumber).validate(filter);
@@ -735,8 +792,9 @@ import { SenderTaggingStore } from './storage/tagging_store/sender_tagging_store
         return this.privateEventStore.getPrivateEvents(eventSelector, sanitizedFilter);
     }
     /**
-   * Stops the PXE's job queue.
-   */ stop() {
-        return this.jobQueue.end();
+   * Stops the PXE's job queue and closes the backing store.
+   */ async stop() {
+        await this.jobQueue.end();
+        await this.db.close();
     }
 }

package/dest/storage/capsule_store/capsule_service.d.ts

@@ -0,0 +1,21 @@
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+import type { Capsule } from '@aztec/stdlib/tx';
+import type { CapsuleStore } from './capsule_store.js';
+/**
+ * Wraps a CapsuleStore with scope-based access control. Each operation asserts that the requested scope is in the
+ * allowed scopes list before delegating to the underlying store.
+ */
+export declare class CapsuleService {
+    private readonly capsuleStore;
+    private readonly allowedScopes;
+    constructor(capsuleStore: CapsuleStore, allowedScopes: AztecAddress[]);
+    setCapsule(contractAddress: AztecAddress, slot: Fr, capsule: Fr[], jobId: string, scope: AztecAddress): void;
+    getCapsule(contractAddress: AztecAddress, slot: Fr, jobId: string, scope: AztecAddress, transientCapsules?: Capsule[]): Promise<Fr[] | null>;
+    deleteCapsule(contractAddress: AztecAddress, slot: Fr, jobId: string, scope: AztecAddress): void;
+    copyCapsule(contractAddress: AztecAddress, srcSlot: Fr, dstSlot: Fr, numEntries: number, jobId: string, scope: AztecAddress): Promise<void>;
+    appendToCapsuleArray(contractAddress: AztecAddress, baseSlot: Fr, content: Fr[][], jobId: string, scope: AztecAddress): Promise<void>;
+    readCapsuleArray(contractAddress: AztecAddress, baseSlot: Fr, jobId: string, scope: AztecAddress): Promise<Fr[][]>;
+    setCapsuleArray(contractAddress: AztecAddress, baseSlot: Fr, content: Fr[][], jobId: string, scope: AztecAddress): Promise<void>;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2Fwc3VsZV9zZXJ2aWNlLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvc3RvcmFnZS9jYXBzdWxlX3N0b3JlL2NhcHN1bGVfc2VydmljZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssRUFBRSxFQUFFLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUN6RCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDM0QsT0FBTyxLQUFLLEVBQUUsT0FBTyxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFFaEQsT0FBTyxLQUFLLEVBQUUsWUFBWSxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFFdkQ7OztHQUdHO0FBQ0gscUJBQWEsY0FBYztJQUV2QixPQUFPLENBQUMsUUFBUSxDQUFDLFlBQVk7SUFDN0IsT0FBTyxDQUFDLFFBQVEsQ0FBQyxhQUFhO0lBRmhDLFlBQ21CLFlBQVksRUFBRSxZQUFZLEVBQzFCLGFBQWEsRUFBRSxZQUFZLEVBQUUsRUFDNUM7SUFFSixVQUFVLENBQUMsZUFBZSxFQUFFLFlBQVksRUFBRSxJQUFJLEVBQUUsRUFBRSxFQUFFLE9BQU8sRUFBRSxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxZQUFZLFFBR3BHO0lBRUssVUFBVSxDQUNkLGVBQWUsRUFBRSxZQUFZLEVBQzdCLElBQUksRUFBRSxFQUFFLEVBQ1IsS0FBSyxFQUFFLE1BQU0sRUFDYixLQUFLLEVBQUUsWUFBWSxFQUNuQixpQkFBaUIsQ0FBQyxFQUFFLE9BQU8sRUFBRSxHQUM1QixPQUFPLENBQUMsRUFBRSxFQUFFLEdBQUcsSUFBSSxDQUFDLENBWXRCO0lBRUQsYUFBYSxDQUFDLGVBQWUsRUFBRSxZQUFZLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxZQUFZLFFBR3hGO0lBRUQsV0FBVyxDQUNULGVBQWUsRUFBRSxZQUFZLEVBQzdCLE9BQU8sRUFBRSxFQUFFLEVBQ1gsT0FBTyxFQUFFLEVBQUUsRUFDWCxVQUFVLEVBQUUsTUFBTSxFQUNsQixLQUFLLEVBQUUsTUFBTSxFQUNiLEtBQUssRUFBRSxZQUFZLEdBQ2xCLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FHZjtJQUVELG9CQUFvQixDQUNsQixlQUFlLEVBQUUsWUFBWSxFQUM3QixRQUFRLEVBQUUsRUFBRSxFQUNaLE9BQU8sRUFBRSxFQUFFLEVBQUUsRUFBRSxFQUNmLEtBQUssRUFBRSxNQUFNLEVBQ2IsS0FBSyxFQUFFLFlBQVksR0FDbEIsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUdmO0lBRUQsZ0JBQWdCLENBQUMsZUFBZSxFQUFFLFlBQVksRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLFlBQVksR0FBRyxPQUFPLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUdqSDtJQUVELGVBQWUsQ0FBQyxlQUFlLEVBQUUsWUFBWSxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsWUFBWSxpQkFHL0c7Q0FDRiJ9

package/dest/storage/capsule_store/capsule_service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capsule_service.d.ts","sourceRoot":"","sources":["../../../src/storage/capsule_store/capsule_service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;GAGG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAFhC,YACmB,YAAY,EAAE,YAAY,EAC1B,aAAa,EAAE,YAAY,EAAE,EAC5C;IAEJ,UAAU,CAAC,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,QAGpG;IAEK,UAAU,CACd,eAAe,EAAE,YAAY,EAC7B,IAAI,EAAE,EAAE,EACR,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,YAAY,EACnB,iBAAiB,CAAC,EAAE,OAAO,EAAE,GAC5B,OAAO,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAYtB;IAED,aAAa,CAAC,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,QAGxF;IAED,WAAW,CACT,eAAe,EAAE,YAAY,EAC7B,OAAO,EAAE,EAAE,EACX,OAAO,EAAE,EAAE,EACX,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC,CAGf;IAED,oBAAoB,CAClB,eAAe,EAAE,YAAY,EAC7B,QAAQ,EAAE,EAAE,EACZ,OAAO,EAAE,EAAE,EAAE,EAAE,EACf,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC,CAGf;IAED,gBAAgB,CAAC,eAAe,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAGjH;IAED,eAAe,CAAC,eAAe,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,iBAG/G;CACF"}

package/dest/storage/capsule_store/capsule_service.js

@@ -0,0 +1,50 @@
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+/**
+ * Wraps a CapsuleStore with scope-based access control. Each operation asserts that the requested scope is in the
+ * allowed scopes list before delegating to the underlying store.
+ */ export class CapsuleService {
+    capsuleStore;
+    allowedScopes;
+    constructor(capsuleStore, allowedScopes){
+        this.capsuleStore = capsuleStore;
+        this.allowedScopes = allowedScopes;
+    }
+    setCapsule(contractAddress, slot, capsule, jobId, scope) {
+        assertAllowedScope(scope, this.allowedScopes);
+        this.capsuleStore.setCapsule(contractAddress, slot, capsule, jobId, scope);
+    }
+    async getCapsule(contractAddress, slot, jobId, scope, transientCapsules) {
+        assertAllowedScope(scope, this.allowedScopes);
+        // TODO(#12425): On the following line, the pertinent capsule gets overshadowed by the transient one. Tackle this.
+        const maybeTransientCapsule = transientCapsules?.find((c)=>c.contractAddress.equals(contractAddress) && c.storageSlot.equals(slot) && (c.scope ?? AztecAddress.ZERO).equals(scope))?.data;
+        return maybeTransientCapsule ?? await this.capsuleStore.getCapsule(contractAddress, slot, jobId, scope);
+    }
+    deleteCapsule(contractAddress, slot, jobId, scope) {
+        assertAllowedScope(scope, this.allowedScopes);
+        this.capsuleStore.deleteCapsule(contractAddress, slot, jobId, scope);
+    }
+    copyCapsule(contractAddress, srcSlot, dstSlot, numEntries, jobId, scope) {
+        assertAllowedScope(scope, this.allowedScopes);
+        return this.capsuleStore.copyCapsule(contractAddress, srcSlot, dstSlot, numEntries, jobId, scope);
+    }
+    appendToCapsuleArray(contractAddress, baseSlot, content, jobId, scope) {
+        assertAllowedScope(scope, this.allowedScopes);
+        return this.capsuleStore.appendToCapsuleArray(contractAddress, baseSlot, content, jobId, scope);
+    }
+    readCapsuleArray(contractAddress, baseSlot, jobId, scope) {
+        assertAllowedScope(scope, this.allowedScopes);
+        return this.capsuleStore.readCapsuleArray(contractAddress, baseSlot, jobId, scope);
+    }
+    setCapsuleArray(contractAddress, baseSlot, content, jobId, scope) {
+        assertAllowedScope(scope, this.allowedScopes);
+        return this.capsuleStore.setCapsuleArray(contractAddress, baseSlot, content, jobId, scope);
+    }
+}
+function assertAllowedScope(scope, allowedScopes) {
+    if (scope.equals(AztecAddress.ZERO)) {
+        return;
+    }
+    if (!allowedScopes.some((allowed)=>allowed.equals(scope))) {
+        throw new Error(`Scope ${scope.toString()} is not in the allowed scopes list: [${allowedScopes.map((s)=>s.toString()).join(', ')}]. See https://docs.aztec.network/errors/10`);
+    }
+}