@aztec/pxe 3.0.0-rc.5 → 4.0.0-nightly.20260107

package/src/entrypoints/server/utils.ts

@@ -1,13 +1,10 @@
+import { BBPrivateKernelProver } from '@aztec/bb-prover/client';
 import { BBBundlePrivateKernelProver } from '@aztec/bb-prover/client/bundle';
 import { randomBytes } from '@aztec/foundation/crypto/random';
-import { type Logger, createLogger } from '@aztec/foundation/log';
+import { createLogger } from '@aztec/foundation/log';
+import { createStore } from '@aztec/kv-store/lmdb-v2';
 import { BundledProtocolContractsProvider } from '@aztec/protocol-contracts/providers/bundle';
-import {
-  type CircuitSimulator,
-  MemoryCircuitRecorder,
-  SimulatorRecorderWrapper,
-  WASMSimulator,
-} from '@aztec/simulator/client';
+import { MemoryCircuitRecorder, SimulatorRecorderWrapper, WASMSimulator } from '@aztec/simulator/client';
 import { FileCircuitRecorder } from '@aztec/simulator/testing';
 import type { AztecNode } from '@aztec/stdlib/interfaces/client';
 
@@ -46,9 +43,6 @@ export async function createPXE(
   };
 
   if (!options.store) {
-    // TODO once https://github.com/AztecProtocol/aztec-packages/issues/13656 is fixed, we can remove this and always
-    // import the lmdb-v2 version
-    const { createStore } = await import('@aztec/kv-store/lmdb-v2');
     const storeLogger = loggers.store
       ? loggers.store
       : createLogger('pxe:data:lmdb' + (logSuffix ? `:${logSuffix}` : ''));
@@ -58,7 +52,13 @@ export async function createPXE(
     ? loggers.prover
     : createLogger('pxe:bb:native' + (logSuffix ? `:${logSuffix}` : ''));
 
-  const prover = options.prover ?? createProver(simulator, proverLogger);
+  let prover;
+  if (options.proverOrOptions instanceof BBPrivateKernelProver) {
+    prover = options.proverOrOptions;
+  } else {
+    prover = new BBBundlePrivateKernelProver(simulator, { ...options.proverOrOptions, logger: proverLogger });
+  }
+
   const protocolContractsProvider = new BundledProtocolContractsProvider();
 
   const pxeLogger = loggers.pxe ? loggers.pxe : createLogger('pxe:service' + (logSuffix ? `:${logSuffix}` : ''));
@@ -73,7 +73,3 @@ export async function createPXE(
   );
   return pxe;
 }
-
-function createProver(simulator: CircuitSimulator, logger?: Logger) {
-  return new BBBundlePrivateKernelProver(simulator, logger);
-}

package/src/error_enriching.ts

@@ -4,18 +4,14 @@ import { FunctionSelector } from '@aztec/stdlib/abi';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { type SimulationError, isNoirCallStackUnresolved } from '@aztec/stdlib/errors';
 
-import type { ContractDataProvider } from './storage/contract_data_provider/contract_data_provider.js';
+import type { ContractStore } from './storage/contract_store/contract_store.js';
 
 /**
  * Adds contract and function names to a simulation error, if they
  * can be found in the PXE database
  * @param err - The error to enrich.
  */
-export async function enrichSimulationError(
-  err: SimulationError,
-  contractDataProvider: ContractDataProvider,
-  logger: Logger,
-) {
+export async function enrichSimulationError(err: SimulationError, contractStore: ContractStore, logger: Logger) {
   // Maps contract addresses to the set of function selectors that were in error.
   // Map and Set do reference equality for their keys instead of value equality, so we store the string
   // representation to get e.g. different contract address objects with the same address value to match.
@@ -34,7 +30,7 @@ export async function enrichSimulationError(
   await Promise.all(
     [...mentionedFunctions.entries()].map(async ([contractAddress, fnSelectors]) => {
       const parsedContractAddress = AztecAddress.fromString(contractAddress);
-      const contract = await contractDataProvider.getContract(parsedContractAddress);
+      const contract = await contractStore.getContract(parsedContractAddress);
       if (contract) {
         err.enrichWithContractName(parsedContractAddress, contract.name);
         // Map from function selector to function name. It uses a stringified key for the same reason as mentionedFunctions.
@@ -68,11 +64,7 @@ export async function enrichSimulationError(
   );
 }
 
-export async function enrichPublicSimulationError(
-  err: SimulationError,
-  contractDataProvider: ContractDataProvider,
-  logger: Logger,
-) {
+export async function enrichPublicSimulationError(err: SimulationError, contractStore: ContractStore, logger: Logger) {
   const callStack = err.getCallStack();
   const originalFailingFunction = callStack[callStack.length - 1];
 
@@ -80,7 +72,7 @@ export async function enrichPublicSimulationError(
     throw new Error(`Original failing function not found when enriching public simulation, missing callstack`);
   }
 
-  const artifact = await contractDataProvider.getPublicFunctionArtifact(originalFailingFunction.contractAddress);
+  const artifact = await contractStore.getPublicFunctionArtifact(originalFailingFunction.contractAddress);
   if (!artifact) {
     throw new Error(
       `Artifact not found when enriching public simulation error. Contract address: ${originalFailingFunction.contractAddress}.`,
@@ -92,7 +84,7 @@ export async function enrichPublicSimulationError(
     err.setOriginalMessage(err.getOriginalMessage() + `${assertionMessage}`);
   }
 
-  const debugInfo = await contractDataProvider.getPublicFunctionDebugMetadata(originalFailingFunction.contractAddress);
+  const debugInfo = await contractStore.getPublicFunctionDebugMetadata(originalFailingFunction.contractAddress);
 
   const noirCallStack = err.getNoirCallStack();
   if (debugInfo) {
@@ -110,6 +102,6 @@ export async function enrichPublicSimulationError(
         );
       }
     }
-    await enrichSimulationError(err, contractDataProvider, logger);
+    await enrichSimulationError(err, contractStore, logger);
   }
 }

package/src/events/event_service.ts

@@ -0,0 +1,77 @@
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { EventSelector } from '@aztec/stdlib/abi';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+import { siloNullifier } from '@aztec/stdlib/hash';
+import type { AztecNode } from '@aztec/stdlib/interfaces/server';
+import { MerkleTreeId } from '@aztec/stdlib/trees';
+import type { TxHash } from '@aztec/stdlib/tx';
+
+import { AnchorBlockStore } from '../storage/anchor_block_store/anchor_block_store.js';
+import { PrivateEventStore } from '../storage/private_event_store/private_event_store.js';
+
+export class EventService {
+  constructor(
+    private readonly anchorBlockStore: AnchorBlockStore,
+    private readonly aztecNode: AztecNode,
+    private readonly privateEventStore: PrivateEventStore,
+  ) {}
+
+  public async deliverEvent(
+    contractAddress: AztecAddress,
+    selector: EventSelector,
+    content: Fr[],
+    eventCommitment: Fr,
+    txHash: TxHash,
+    scope: AztecAddress,
+  ): Promise<void> {
+    // While using 'latest' block number would be fine for private events since they cannot be accessed from Aztec.nr
+    // (and thus we're less concerned about being ahead of the synced block), we use the synced block number to
+    // maintain consistent behavior in the PXE. Additionally, events should never be ahead of the synced block here
+    // since `fetchTaggedLogs` only processes logs up to the synced block.
+    const [syncedBlockHeader, siloedEventCommitment, txEffect] = await Promise.all([
+      this.anchorBlockStore.getBlockHeader(),
+      siloNullifier(contractAddress, eventCommitment),
+      this.aztecNode.getTxEffect(txHash),
+    ]);
+
+    const syncedBlockNumber = syncedBlockHeader.getBlockNumber();
+
+    if (!txEffect) {
+      throw new Error(`Could not find tx effect for tx hash ${txHash}`);
+    }
+
+    if (txEffect.l2BlockNumber > syncedBlockNumber) {
+      throw new Error(`Could not find tx effect for tx hash ${txHash} as of block number ${syncedBlockNumber}`);
+    }
+
+    const eventInTx = txEffect.data.nullifiers.some(n => n.equals(siloedEventCommitment));
+    if (!eventInTx) {
+      throw new Error(
+        `Event commitment ${eventCommitment} (siloed as ${siloedEventCommitment}) is not present in tx ${txHash}`,
+      );
+    }
+
+    const [nullifierIndex] = await this.aztecNode.findLeavesIndexes(syncedBlockNumber, MerkleTreeId.NULLIFIER_TREE, [
+      siloedEventCommitment,
+    ]);
+
+    if (nullifierIndex === undefined) {
+      throw new Error(
+        `Event commitment ${eventCommitment} (siloed as ${siloedEventCommitment}) is not present on the nullifier tree at block ${syncedBlockNumber} (from tx ${txHash})`,
+      );
+    }
+
+    return this.privateEventStore.storePrivateEventLog(
+      selector,
+      content,
+      Number(nullifierIndex.data), // Index of the event commitment in the nullifier tree
+      {
+        contractAddress,
+        scope,
+        txHash,
+        l2BlockNumber: nullifierIndex.l2BlockNumber, // Block number in which the event was emitted
+        l2BlockHash: nullifierIndex.l2BlockHash, // Block hash in which the event was emitted
+      },
+    );
+  }
+}

package/src/events/private_event_filter_validator.ts

@@ -2,12 +2,13 @@ import type { PrivateEventFilter } from '@aztec/aztec.js/wallet';
 import { INITIAL_L2_BLOCK_NUM } from '@aztec/constants';
 import { BlockNumber } from '@aztec/foundation/branded-types';
 
-import type { PrivateEventDataProviderFilter, SyncDataProvider } from '../storage/index.js';
+import { AnchorBlockStore } from '../storage/anchor_block_store/anchor_block_store.js';
+import type { PrivateEventStoreFilter } from '../storage/private_event_store/private_event_store.js';
 
 export class PrivateEventFilterValidator {
-  constructor(private syncDataProvider: SyncDataProvider) {}
+  constructor(private anchorBlockStore: AnchorBlockStore) {}
 
-  async validate(filter: PrivateEventFilter): Promise<PrivateEventDataProviderFilter> {
+  async validate(filter: PrivateEventFilter): Promise<PrivateEventStoreFilter> {
     let { fromBlock, toBlock } = filter;
 
     // Block range filters in Aztec Node are defined as closed-open intervals [fromBlock, toBlock), so
@@ -15,7 +16,7 @@ export class PrivateEventFilterValidator {
     // We then default to [INITIAL_L2_BLOCK_NUM, latestKnownBlock + 1), ie: by default return events from
     // the first block to the latest known block.
     if (!fromBlock || !toBlock) {
-      const lastKnownBlock = await this.syncDataProvider.getBlockNumber();
+      const lastKnownBlock = (await this.anchorBlockStore.getBlockHeader()).getBlockNumber();
       fromBlock = fromBlock ?? BlockNumber(INITIAL_L2_BLOCK_NUM);
       toBlock = toBlock ?? BlockNumber(lastKnownBlock + 1);
     }

package/src/logs/log_service.ts

@@ -0,0 +1,202 @@
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import { createLogger } from '@aztec/foundation/log';
+import type { KeyStore } from '@aztec/key-store';
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+import type { CompleteAddress } from '@aztec/stdlib/contract';
+import type { AztecNode } from '@aztec/stdlib/interfaces/server';
+import { DirectionalAppTaggingSecret, PendingTaggedLog, SiloedTag, Tag, TxScopedL2Log } from '@aztec/stdlib/logs';
+
+import type { LogRetrievalRequest } from '../contract_function_simulator/noir-structs/log_retrieval_request.js';
+import { LogRetrievalResponse } from '../contract_function_simulator/noir-structs/log_retrieval_response.js';
+import { AddressStore } from '../storage/address_store/address_store.js';
+import { AnchorBlockStore } from '../storage/anchor_block_store/anchor_block_store.js';
+import { CapsuleStore } from '../storage/capsule_store/capsule_store.js';
+import type { RecipientTaggingStore } from '../storage/tagging_store/recipient_tagging_store.js';
+import type { SenderAddressBookStore } from '../storage/tagging_store/sender_address_book_store.js';
+import { loadPrivateLogsForSenderRecipientPair } from '../tagging/index.js';
+
+export class LogService {
+  private log = createLogger('log_service');
+
+  constructor(
+    private readonly aztecNode: AztecNode,
+    private readonly anchorBlockStore: AnchorBlockStore,
+    private readonly keyStore: KeyStore,
+    private readonly capsuleStore: CapsuleStore,
+    private readonly recipientTaggingStore: RecipientTaggingStore,
+    private readonly senderAddressBookStore: SenderAddressBookStore,
+    private readonly addressStore: AddressStore,
+  ) {}
+
+  public async bulkRetrieveLogs(logRetrievalRequests: LogRetrievalRequest[]): Promise<(LogRetrievalResponse | null)[]> {
+    return await Promise.all(
+      logRetrievalRequests.map(async request => {
+        const [publicLog, privateLog] = await Promise.all([
+          this.#getPublicLogByTag(request.tag, request.contractAddress),
+          this.#getPrivateLogByTag(await SiloedTag.compute(request.tag, request.contractAddress)),
+        ]);
+
+        if (publicLog !== null && privateLog !== null) {
+          throw new Error(
+            `Found both a public and private log when searching for tag ${request.tag} from contract ${request.contractAddress}`,
+          );
+        }
+
+        return publicLog ?? privateLog;
+      }),
+    );
+  }
+
+  async #getPublicLogByTag(tag: Tag, contractAddress: AztecAddress): Promise<LogRetrievalResponse | null> {
+    const logs = await this.aztecNode.getPublicLogsByTagsFromContract(contractAddress, [tag]);
+    const logsForTag = logs[0];
+
+    if (logsForTag.length == 0) {
+      return null;
+    } else if (logsForTag.length > 1) {
+      // TODO(#11627): handle this case
+      throw new Error(
+        `Got ${logsForTag.length} logs for tag ${tag} and contract ${contractAddress.toString()}. getPublicLogByTag currently only supports a single log per tag`,
+      );
+    }
+
+    const scopedLog = logsForTag[0];
+
+    return new LogRetrievalResponse(
+      scopedLog.logData.slice(1), // Skip the tag
+      scopedLog.txHash,
+      scopedLog.noteHashes,
+      scopedLog.firstNullifier,
+    );
+  }
+
+  async #getPrivateLogByTag(siloedTag: SiloedTag): Promise<LogRetrievalResponse | null> {
+    const logs = await this.aztecNode.getPrivateLogsByTags([siloedTag]);
+    const logsForTag = logs[0];
+
+    if (logsForTag.length == 0) {
+      return null;
+    } else if (logsForTag.length > 1) {
+      // TODO(#11627): handle this case
+      throw new Error(
+        `Got ${logsForTag.length} logs for tag ${siloedTag}. getPrivateLogByTag currently only supports a single log per tag`,
+      );
+    }
+
+    const scopedLog = logsForTag[0];
+
+    return new LogRetrievalResponse(
+      scopedLog.logData.slice(1), // Skip the tag
+      scopedLog.txHash,
+      scopedLog.noteHashes,
+      scopedLog.firstNullifier,
+    );
+  }
+
+  public async syncTaggedLogs(
+    contractAddress: AztecAddress,
+    pendingTaggedLogArrayBaseSlot: Fr,
+    scopes?: AztecAddress[],
+  ) {
+    this.log.verbose('Searching for tagged logs', { contract: contractAddress });
+
+    // We only load logs from block up to and including the anchor block number
+    const anchorBlockNumber = (await this.anchorBlockStore.getBlockHeader()).getBlockNumber();
+
+    // Determine recipients: use scopes if provided, otherwise get all accounts
+    const recipients = scopes && scopes.length > 0 ? scopes : await this.keyStore.getAccounts();
+
+    // For each recipient, fetch secrets, load logs, and store them.
+    // We run these per-recipient tasks in parallel so that logs are loaded for all recipients concurrently.
+    await Promise.all(
+      recipients.map(async recipient => {
+        // Get all secrets for this recipient (one per sender)
+        const secrets = await this.#getSecretsForSenders(contractAddress, recipient);
+
+        // Load logs for all sender-recipient pairs in parallel
+        const logArrays = await Promise.all(
+          secrets.map(secret =>
+            loadPrivateLogsForSenderRecipientPair(
+              secret,
+              contractAddress,
+              this.aztecNode,
+              this.recipientTaggingStore,
+              anchorBlockNumber,
+            ),
+          ),
+        );
+
+        // Flatten all logs from all secrets
+        const allLogs = logArrays.flat();
+
+        // Store the logs for this recipient
+        if (allLogs.length > 0) {
+          await this.#storePendingTaggedLogs(contractAddress, pendingTaggedLogArrayBaseSlot, recipient, allLogs);
+        }
+      }),
+    );
+  }
+
+  async #getSecretsForSenders(
+    contractAddress: AztecAddress,
+    recipient: AztecAddress,
+  ): Promise<DirectionalAppTaggingSecret[]> {
+    const recipientCompleteAddress = await this.#getCompleteAddress(recipient);
+    const recipientIvsk = await this.keyStore.getMasterIncomingViewingSecretKey(recipient);
+
+    // We implicitly add all PXE accounts as senders, this helps us decrypt tags on notes that we send to ourselves
+    // (recipient = us, sender = us)
+    const allSenders = [...(await this.senderAddressBookStore.getSenders()), ...(await this.keyStore.getAccounts())];
+
+    // We deduplicate the senders by adding them to a set and then converting the set back to an array
+    const deduplicatedSenders = Array.from(new Set(allSenders.map(sender => sender.toString()))).map(sender =>
+      AztecAddress.fromString(sender),
+    );
+
+    return Promise.all(
+      deduplicatedSenders.map(sender => {
+        return DirectionalAppTaggingSecret.compute(
+          recipientCompleteAddress,
+          recipientIvsk,
+          sender,
+          contractAddress,
+          recipient,
+        );
+      }),
+    );
+  }
+
+  #storePendingTaggedLogs(
+    contractAddress: AztecAddress,
+    capsuleArrayBaseSlot: Fr,
+    recipient: AztecAddress,
+    privateLogs: TxScopedL2Log[],
+  ) {
+    // Build all pending tagged logs from the scoped logs
+    const pendingTaggedLogs = privateLogs.map(scopedLog => {
+      const pendingTaggedLog = new PendingTaggedLog(
+        scopedLog.logData,
+        scopedLog.txHash,
+        scopedLog.noteHashes,
+        scopedLog.firstNullifier,
+        recipient,
+      );
+
+      return pendingTaggedLog.toFields();
+    });
+
+    // TODO: This looks like it could belong more at the oracle interface level
+    return this.capsuleStore.appendToCapsuleArray(contractAddress, capsuleArrayBaseSlot, pendingTaggedLogs);
+  }
+
+  async #getCompleteAddress(account: AztecAddress): Promise<CompleteAddress> {
+    const completeAddress = await this.addressStore.getCompleteAddress(account);
+    if (!completeAddress) {
+      throw new Error(
+        `No public key registered for address ${account}.
+				Register it by calling pxe.addAccount(...).\nSee docs for context: https://docs.aztec.network/developers/resources/debugging/aztecnr-errors#simulation-error-no-public-key-registered-for-address-0x0-register-it-by-calling-pxeregisterrecipient-or-pxeregisteraccount`,
+      );
+    }
+    return completeAddress;
+  }
+}

package/src/notes/index.ts

@@ -0,0 +1 @@
+export { NoteService } from './note_service.js';

package/src/notes/note_service.ts

@@ -0,0 +1,200 @@
+import { Fr } from '@aztec/foundation/curves/bn254';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+import type { DataInBlock } from '@aztec/stdlib/block';
+import { computeUniqueNoteHash, siloNoteHash, siloNullifier } from '@aztec/stdlib/hash';
+import { type AztecNode, MAX_RPC_LEN } from '@aztec/stdlib/interfaces/client';
+import { Note, NoteDao, NoteStatus } from '@aztec/stdlib/note';
+import { MerkleTreeId } from '@aztec/stdlib/trees';
+import type { TxHash } from '@aztec/stdlib/tx';
+
+import type { AnchorBlockStore } from '../storage/anchor_block_store/anchor_block_store.js';
+import type { NoteStore } from '../storage/note_store/note_store.js';
+
+export class NoteService {
+  constructor(
+    private readonly noteStore: NoteStore,
+    private readonly aztecNode: AztecNode,
+    private readonly anchorBlockStore: AnchorBlockStore,
+  ) {}
+
+  /**
+   * Retrieves a set of notes stored in the database for a given contract address and storage slot.
+   * The query result is paginated using 'limit' and 'offset' values.
+   * Returns an object containing an array of note data.
+   *
+   * @param owner - The owner of the notes. If undefined, returns notes for all known owners.
+   * @param status - The status of notes to fetch.
+   * @param scopes - The accounts whose notes we can access in this call. Currently optional and will default to all.
+   */
+  public async getNotes(
+    contractAddress: AztecAddress,
+    owner: AztecAddress | undefined,
+    storageSlot: Fr,
+    status: NoteStatus,
+    scopes?: AztecAddress[],
+  ) {
+    const noteDaos = await this.noteStore.getNotes({
+      contractAddress,
+      owner,
+      storageSlot,
+      status,
+      scopes,
+    });
+    return noteDaos.map(
+      ({ contractAddress, owner, storageSlot, randomness, noteNonce, note, noteHash, siloedNullifier, index }) => ({
+        contractAddress,
+        owner,
+        storageSlot,
+        randomness,
+        noteNonce,
+        note,
+        noteHash,
+        siloedNullifier,
+        // PXE can use this index to get full MembershipWitness
+        index,
+      }),
+    );
+  }
+
+  /**
+   * Looks for nullifiers of active contract notes and marks them as nullified if a nullifier is found.
+   *
+   * Fetches notes from the NoteStore and checks which nullifiers are present in the
+   * onchain nullifier Merkle tree - up to the latest locally synced block. We use the
+   * locally synced block instead of querying the chain's 'latest' block to ensure correctness:
+   * notes are only marked nullified once their corresponding nullifier has been included in a
+   * block up to which the PXE has synced.
+   * This allows recent nullifications to be processed even if the node is not an archive node.
+   *
+   * @param contractAddress - The contract whose notes should be checked and nullified.
+   */
+  public async syncNoteNullifiers(contractAddress: AztecAddress): Promise<void> {
+    const syncedBlockNumber = (await this.anchorBlockStore.getBlockHeader()).getBlockNumber();
+
+    const contractNotes = await this.noteStore.getNotes({ contractAddress });
+
+    if (contractNotes.length === 0) {
+      return;
+    }
+
+    const nullifiersToCheck = contractNotes.map(note => note.siloedNullifier);
+    const nullifierBatches = nullifiersToCheck.reduce(
+      (acc, nullifier) => {
+        if (acc[acc.length - 1].length < MAX_RPC_LEN) {
+          acc[acc.length - 1].push(nullifier);
+        } else {
+          acc.push([nullifier]);
+        }
+        return acc;
+      },
+      [[]] as Fr[][],
+    );
+    const nullifierIndexes = (
+      await Promise.all(
+        nullifierBatches.map(batch =>
+          this.aztecNode.findLeavesIndexes(syncedBlockNumber, MerkleTreeId.NULLIFIER_TREE, batch),
+        ),
+      )
+    ).flat();
+
+    const foundNullifiers = nullifiersToCheck
+      .map((nullifier, i) => {
+        if (nullifierIndexes[i] !== undefined) {
+          return { ...nullifierIndexes[i], ...{ data: nullifier } } as DataInBlock<Fr>;
+        }
+      })
+      .filter(nullifier => nullifier !== undefined) as DataInBlock<Fr>[];
+
+    await this.noteStore.applyNullifiers(foundNullifiers);
+  }
+
+  public async deliverNote(
+    contractAddress: AztecAddress,
+    owner: AztecAddress,
+    storageSlot: Fr,
+    randomness: Fr,
+    noteNonce: Fr,
+    content: Fr[],
+    noteHash: Fr,
+    nullifier: Fr,
+    txHash: TxHash,
+    recipient: AztecAddress,
+  ): Promise<void> {
+    // We are going to store the new note in the NoteStore, which will let us later return it via `getNotes`.
+    // There's two things we need to check before we do this however:
+    //  - we must make sure the note does actually exist in the note hash tree
+    //  - we need to check if the note has already been nullified
+    //
+    // Failing to do either of the above would result in circuits getting either non-existent notes and failing to
+    // produce inclusion proofs for them, or getting nullified notes and producing duplicate nullifiers, both of which
+    // are catastrophic failure modes.
+    //
+    // Note that adding a note and removing it is *not* equivalent to never adding it in the first place. A nullifier
+    // emitted in a block that comes after note creation might result in the note being de-nullified by a chain reorg,
+    // so we must store both the note hash and nullifier block information.
+
+    // We avoid making node queries at 'latest' since we don't want to process notes or nullifiers that only exist ahead
+    // in time of the locally synced state.
+    // Note that while this technically results in historical queries, we perform it at the latest locally synced block
+    // number which *should* be recent enough to be available, even for non-archive nodes.
+    // Also note that the note should never be ahead of the synced block here since `fetchTaggedLogs` only processes
+    // logs up to the synced block making this only an additional safety check.
+    const syncedBlockNumber = (await this.anchorBlockStore.getBlockHeader()).getBlockNumber();
+
+    // By computing siloed and unique note hashes ourselves we prevent contracts from interfering with the note storage
+    // of other contracts, which would constitute a security breach.
+    const uniqueNoteHash = await computeUniqueNoteHash(noteNonce, await siloNoteHash(contractAddress, noteHash));
+    const siloedNullifier = await siloNullifier(contractAddress, nullifier);
+
+    const txEffect = await this.aztecNode.getTxEffect(txHash);
+    if (!txEffect) {
+      throw new Error(`Could not find tx effect for tx hash ${txHash}`);
+    }
+
+    if (txEffect.l2BlockNumber > syncedBlockNumber) {
+      throw new Error(`Could not find tx effect for tx hash ${txHash} as of block number ${syncedBlockNumber}`);
+    }
+
+    const noteInTx = txEffect.data.noteHashes.some(nh => nh.equals(uniqueNoteHash));
+    if (!noteInTx) {
+      throw new Error(`Note hash ${noteHash} (uniqued as ${uniqueNoteHash}) is not present in tx ${txHash}`);
+    }
+
+    // We store notes by their index in the global note hash tree, which has the convenient side effect of validating
+    // note existence in said tree. We concurrently also check if the note's nullifier exists, performing all node
+    // queries in a single round-trip.
+    const [[uniqueNoteHashTreeIndexInBlock], [nullifierIndex]] = await Promise.all([
+      this.aztecNode.findLeavesIndexes(syncedBlockNumber, MerkleTreeId.NOTE_HASH_TREE, [uniqueNoteHash]),
+      this.aztecNode.findLeavesIndexes(syncedBlockNumber, MerkleTreeId.NULLIFIER_TREE, [siloedNullifier]),
+    ]);
+
+    if (uniqueNoteHashTreeIndexInBlock === undefined) {
+      throw new Error(
+        `Note hash ${noteHash} (uniqued as ${uniqueNoteHash}) is not present on the tree at block ${syncedBlockNumber} (from tx ${txHash})`,
+      );
+    }
+
+    const noteDao = new NoteDao(
+      new Note(content),
+      contractAddress,
+      owner,
+      storageSlot,
+      randomness,
+      noteNonce,
+      noteHash,
+      siloedNullifier,
+      txHash,
+      uniqueNoteHashTreeIndexInBlock.l2BlockNumber,
+      uniqueNoteHashTreeIndexInBlock.l2BlockHash.toString(),
+      uniqueNoteHashTreeIndexInBlock.data,
+    );
+
+    // The note was found by `recipient`, so we use that as the scope when storing the note.
+    await this.noteStore.addNotes([noteDao], recipient);
+
+    if (nullifierIndex !== undefined) {
+      const { data: _, ...blockHashAndNum } = nullifierIndex;
+      await this.noteStore.applyNullifiers([{ data: siloedNullifier, ...blockHashAndNum }]);
+    }
+  }
+}

package/src/private_kernel/private_kernel_oracle_impl.ts

@@ -18,7 +18,7 @@ import { UpdatedClassIdHints } from '@aztec/stdlib/kernel';
 import type { NullifierMembershipWitness } from '@aztec/stdlib/trees';
 import type { VerificationKeyAsFields } from '@aztec/stdlib/vks';
 
-import type { ContractDataProvider } from '../storage/index.js';
+import type { ContractStore } from '../storage/contract_store/contract_store.js';
 import type { PrivateKernelOracle } from './private_kernel_oracle.js';
 
 // TODO: Block number should not be "latest".
@@ -29,7 +29,7 @@ import type { PrivateKernelOracle } from './private_kernel_oracle.js';
  */
 export class PrivateKernelOracleImpl implements PrivateKernelOracle {
   constructor(
-    private contractDataProvider: ContractDataProvider,
+    private contractStore: ContractStore,
     private keyStore: KeyStore,
     private node: AztecNode,
     private blockNumber: BlockParameter = 'latest',
@@ -37,7 +37,7 @@ export class PrivateKernelOracleImpl implements PrivateKernelOracle {
   ) {}
 
   public async getContractAddressPreimage(address: AztecAddress) {
-    const instance = await this.contractDataProvider.getContractInstance(address);
+    const instance = await this.contractStore.getContractInstance(address);
     if (!instance) {
       throw new Error(`Contract instance not found when getting address preimage. Contract address: ${address}.`);
     }
@@ -48,7 +48,7 @@ export class PrivateKernelOracleImpl implements PrivateKernelOracle {
   }
 
   public async getContractClassIdPreimage(contractClassId: Fr) {
-    const contractClass = await this.contractDataProvider.getContractClass(contractClassId);
+    const contractClass = await this.contractStore.getContractClass(contractClassId);
     if (!contractClass) {
       throw new Error(`Contract class not found when getting class id preimage. Class id: ${contractClassId}.`);
     }
@@ -56,7 +56,7 @@ export class PrivateKernelOracleImpl implements PrivateKernelOracle {
   }
 
   public async getFunctionMembershipWitness(contractClassId: Fr, selector: FunctionSelector) {
-    const membershipWitness = await this.contractDataProvider.getFunctionMembershipWitness(contractClassId, selector);
+    const membershipWitness = await this.contractStore.getFunctionMembershipWitness(contractClassId, selector);
     if (!membershipWitness) {
       throw new Error(
         `Membership witness not found for contract class id ${contractClassId} and selector ${selector}.`,
@@ -96,7 +96,7 @@ export class PrivateKernelOracleImpl implements PrivateKernelOracle {
   }
 
   public getDebugFunctionName(contractAddress: AztecAddress, selector: FunctionSelector): Promise<string> {
-    return this.contractDataProvider.getDebugFunctionName(contractAddress, selector);
+    return this.contractStore.getDebugFunctionName(contractAddress, selector);
   }
 
   public async getUpdatedClassIdHints(contractAddress: AztecAddress): Promise<UpdatedClassIdHints> {