@aztec/pxe 5.0.0-rc.2 → 5.0.0

package/dest/pxe.js

@@ -1,21 +1,23 @@
 import { BlockNumber } from '@aztec/foundation/branded-types';
+import { Point } from '@aztec/foundation/curves/grumpkin';
 import { createLogger } from '@aztec/foundation/log';
 import { SerialQueue } from '@aztec/foundation/queue';
 import { Timer } from '@aztec/foundation/timer';
 import { protocolContractNames } from '@aztec/protocol-contracts';
 import { FunctionType, decodeFunctionSignature } from '@aztec/stdlib/abi';
 import { GENESIS_BLOCK_HEADER_HASH } from '@aztec/stdlib/block';
-import { computeContractAddressFromInstance, getContractClassFromArtifact } from '@aztec/stdlib/contract';
+import { computeContractAddressFromInstance } from '@aztec/stdlib/contract';
 import { SimulationError } from '@aztec/stdlib/errors';
+import { computeAddressSecret } from '@aztec/stdlib/keys';
+import { deriveEcdhSharedSecretPoint } from '@aztec/stdlib/logs';
 import { PrivateSimulationResult, TxProfileResult, TxProvingResult, TxSimulationResult } from '@aztec/stdlib/tx';
 import { inspect } from 'util';
 import { BlockSynchronizer } from './block_synchronizer/index.js';
+import { ContractClassService } from './contract/contract_class_service.js';
+import { ContractSyncService } from './contract/contract_sync_service.js';
 import { BenchmarkedNodeFactory } from './contract_function_simulator/benchmarked_node.js';
 import { ContractFunctionSimulator, generateSimulatedProvingResult } from './contract_function_simulator/contract_function_simulator.js';
-import { ProxiedContractStoreFactory } from './contract_function_simulator/proxied_contract_data_source.js';
 import { displayDebugLogs } from './contract_logging.js';
-import { ContractSyncService } from './contract_sync/contract_sync_service.js';
-import { readCurrentClassId } from './contract_sync/helpers.js';
 import { PXEDebugUtils } from './debug/pxe_debug_utils.js';
 import { enrichPublicSimulationError, enrichSimulationError } from './error_enriching.js';
 import { PrivateEventFilterValidator } from './events/private_event_filter_validator.js';
@@ -45,6 +47,7 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
     addressStore;
     privateEventStore;
     contractSyncService;
+    contractClassService;
     txResolver;
     l2TipsStore;
     simulator;
@@ -58,7 +61,7 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
     jobCoordinator;
     debug;
     hooks;
-    constructor(node, nodeDebug, db, blockStateSynchronizer, keyStore, contractStore, noteStore, capsuleStore, factStore, anchorBlockStore, senderTaggingStore, taggingSecretSourcesStore, recipientTaggingStore, addressStore, privateEventStore, contractSyncService, txResolver, l2TipsStore, simulator, proverEnabled, autoSync, proofCreator, protocolContractsProvider, preloadedContractsProvider, log, jobQueue, jobCoordinator, debug, hooks){
+    constructor(node, nodeDebug, db, blockStateSynchronizer, keyStore, contractStore, noteStore, capsuleStore, factStore, anchorBlockStore, senderTaggingStore, taggingSecretSourcesStore, recipientTaggingStore, addressStore, privateEventStore, contractSyncService, contractClassService, txResolver, l2TipsStore, simulator, proverEnabled, autoSync, proofCreator, protocolContractsProvider, preloadedContractsProvider, log, jobQueue, jobCoordinator, debug, hooks){
         this.node = node;
         this.nodeDebug = nodeDebug;
         this.db = db;
@@ -75,6 +78,7 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
         this.addressStore = addressStore;
         this.privateEventStore = privateEventStore;
         this.contractSyncService = contractSyncService;
+        this.contractClassService = contractClassService;
         this.txResolver = txResolver;
         this.l2TipsStore = l2TipsStore;
         this.simulator = simulator;
@@ -109,9 +113,10 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
         const initialBlockHash = (await node.getBlock(BlockNumber.ZERO))?.hash ?? GENESIS_BLOCK_HEADER_HASH;
         const proverEnabled = config.proverEnabled !== undefined ? config.proverEnabled : info.realProofs;
         const { addressStore, privateEventStore, contractStore, noteStore, anchorBlockStore, senderTaggingStore, taggingSecretSourcesStore, recipientTaggingStore, capsuleStore, keyStore, l2TipsStore, factStore } = openPxeStores(store, initialBlockHash);
-        const contractSyncService = new ContractSyncService(node, contractStore, noteStore, createLogger('pxe:contract_sync', bindings));
+        const contractClassService = new ContractClassService(node, contractStore);
+        const contractSyncService = new ContractSyncService(node, contractStore, contractClassService, noteStore, createLogger('pxe:contract_sync', bindings));
         const txResolver = new TxResolverService(node);
-        const synchronizer = new BlockSynchronizer(node, store, anchorBlockStore, noteStore, privateEventStore, factStore, l2TipsStore, contractSyncService, config, bindings);
+        const synchronizer = new BlockSynchronizer(node, store, anchorBlockStore, noteStore, privateEventStore, factStore, l2TipsStore, contractSyncService, contractClassService, config, bindings);
         const jobCoordinator = new JobCoordinator(store, bindings);
         jobCoordinator.registerStores([
             capsuleStore,
@@ -124,7 +129,7 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
         ]);
         const debugUtils = new PXEDebugUtils(contractSyncService, noteStore, synchronizer, anchorBlockStore);
         const jobQueue = new SerialQueue();
-        const pxe = new PXE(node, nodeDebug, store, synchronizer, keyStore, contractStore, noteStore, capsuleStore, factStore, anchorBlockStore, senderTaggingStore, taggingSecretSourcesStore, recipientTaggingStore, addressStore, privateEventStore, contractSyncService, txResolver, l2TipsStore, simulator, proverEnabled, config.autoSync, proofCreator, protocolContractsProvider, preloadedContractsProvider, log, jobQueue, jobCoordinator, debugUtils, hooks);
+        const pxe = new PXE(node, nodeDebug, store, synchronizer, keyStore, contractStore, noteStore, capsuleStore, factStore, anchorBlockStore, senderTaggingStore, taggingSecretSourcesStore, recipientTaggingStore, addressStore, privateEventStore, contractSyncService, contractClassService, txResolver, l2TipsStore, simulator, proverEnabled, config.autoSync, proofCreator, protocolContractsProvider, preloadedContractsProvider, log, jobQueue, jobCoordinator, debugUtils, hooks);
         debugUtils.setPXEHelpers(pxe.#putInJobQueue.bind(pxe), pxe.#getSimulatorForTx.bind(pxe), pxe.#executeUtility.bind(pxe));
         pxe.jobQueue.start();
         await Promise.all([
@@ -136,9 +141,10 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
     }
     // Internal methods
     #getSimulatorForTx(overrides) {
-        const proxyContractStore = ProxiedContractStoreFactory.create(this.contractStore, overrides?.contracts);
         return new ContractFunctionSimulator({
-            contractStore: proxyContractStore,
+            contractStore: this.contractStore,
+            contractClassService: this.contractClassService,
+            overrides: overrides?.contracts,
             noteStore: this.noteStore,
             keyStore: this.keyStore,
             addressStore: this.addressStore,
@@ -156,6 +162,22 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
             hooks: this.hooks
         });
     }
+    /** Best-effort debug function name for the class `address` runs at `anchorBlockHeader`. Used for log display only. */ async #getDebugFunctionName(address, selector, anchorBlockHeader) {
+        try {
+            const classId = await this.contractClassService.getCurrentClassId(address, anchorBlockHeader);
+            return classId ? await this.contractStore.getDebugFunctionName(classId, selector) : `${address}:${selector}`;
+        } catch  {
+            return `${address}:${selector}`;
+        }
+    }
+    /** Best-effort debug contract name for the class `address` runs at `anchorBlockHeader`. Used for log display only. */ async #getDebugContractName(address, anchorBlockHeader) {
+        try {
+            const classId = await this.contractClassService.getCurrentClassId(address, anchorBlockHeader);
+            return classId ? await this.contractStore.getDebugContractName(classId) : undefined;
+        } catch  {
+            return undefined;
+        }
+    }
     #contextualizeError(err, ...context) {
         let contextStr = '';
         if (context.length > 0) {
@@ -208,10 +230,12 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
     }
     async #registerPreloadedContracts() {
         const contracts = await this.preloadedContractsProvider.getPreloadedContracts();
-        await Promise.all(contracts.map(({ instance, artifact })=>this.registerContract({
-                instance,
-                artifact
-            })));
+        await Promise.all(contracts.map(async ({ instance, artifact })=>{
+            if (artifact) {
+                await this.registerContractClass(artifact);
+            }
+            await this.registerContract(instance);
+        }));
         this.log.verbose(`Registered preloaded contracts in pxe`, {
             contracts: contracts.map(({ instance })=>instance.address.toString())
         });
@@ -232,7 +256,7 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
             return result;
         } catch (err) {
             if (err instanceof SimulationError) {
-                await enrichSimulationError(err, this.contractStore, this.log);
+                await enrichSimulationError(err, this.contractStore, this.contractClassService, anchorBlockHeader, this.log);
             }
             throw err;
         }
@@ -256,7 +280,8 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
             };
         } catch (err) {
             if (err instanceof SimulationError) {
-                await enrichSimulationError(err, this.contractStore, this.log);
+                const anchorBlockHeader = await this.anchorBlockStore.getBlockHeader();
+                await enrichSimulationError(err, this.contractStore, this.contractClassService, anchorBlockHeader, this.log);
             }
             throw err;
         }
@@ -278,7 +303,8 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
         } catch (err) {
             if (err instanceof SimulationError) {
                 try {
-                    await enrichPublicSimulationError(err, this.contractStore, this.log);
+                    const anchorBlockHeader = await this.anchorBlockStore.getBlockHeader();
+                    await enrichPublicSimulationError(err, this.contractStore, this.contractClassService, anchorBlockHeader, this.log);
                 } catch (enrichErr) {
                     this.log.error(`Failed to enrich public simulation error: ${enrichErr}`);
                 }
@@ -297,7 +323,7 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
    * @param config - The configuration for the kernel execution prover.
    * @returns An object that contains the output of the kernel execution, including the ChonkProof if proving is enabled.
    */ async #prove(txExecutionRequest, proofCreator, privateExecutionResult, anchorBlockHeader, config) {
-        const kernelOracle = new PrivateKernelOracle(this.contractStore, this.keyStore, this.node, anchorBlockHeader);
+        const kernelOracle = new PrivateKernelOracle(this.contractStore, this.contractClassService, this.keyStore, this.node, anchorBlockHeader);
         const kernelTraceProver = new PrivateKernelExecutionProver(kernelOracle, proofCreator, !this.proverEnabled, this.log.getBindings());
         this.log.debug(`Executing kernel trace prover (${JSON.stringify(config)})...`);
         return await kernelTraceProver.proveWithKernels(txExecutionRequest.toTxRequest(), privateExecutionResult, config);
@@ -328,9 +354,9 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
         });
     }
     /**
-   * Returns the contract instance for a given address, if it's registered in the PXE.
+   * Returns the address preimage of the contract instance at a given address, if it's registered in the PXE.
    * @param address - The contract address.
-   * @returns The contract instance if found, undefined otherwise.
+   * @returns The contract instance address preimage if found, undefined otherwise.
    */ getContractInstance(address) {
         return this.contractStore.getContractInstance(address);
     }
@@ -342,17 +368,21 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
         return await this.contractStore.getContractArtifact(id);
     }
     /**
-   * Registers a user account in PXE given its master encryption private key.
-   * Once a new account is registered, the PXE will trial-decrypt all published notes on
-   * the chain and store those that correspond to the registered account. Will do nothing if the
-   * account is already registered.
+   * Registers a user account in PXE.
+   *
+   * PXE holds the account's four privacy secret keys but only the *public* message-signing and fallback keys: their
+   * secret keys are withheld, since PXE is not trusted to hold them.
+   *
+   * Does nothing if the account is already registered.
    *
-   * @param secretKey - Secret key of the corresponding user master public key.
+   * The four privacy secret keys can be retrieved later with {@link getAccountSecretKeys}.
+   *
+   * @param keys - The account's privacy keys: four secret keys plus the message-signing and fallback public keys.
    * @param partialAddress - The partial address of the account contract corresponding to the account being registered.
    * @returns The complete address of the account.
-   */ async registerAccount(secretKey, partialAddress) {
+   */ async registerAccount(keys, partialAddress) {
         const accounts = await this.keyStore.getAccounts();
-        const accountCompleteAddress = await this.keyStore.addAccount(secretKey, partialAddress);
+        const accountCompleteAddress = await this.keyStore.addAccount(keys, partialAddress);
         if (accounts.some((a)=>a.equals(accountCompleteAddress.address))) {
             this.log.info(`Account:\n "${accountCompleteAddress.address.toString()}"\n already registered.`);
             return accountCompleteAddress;
@@ -364,6 +394,22 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
         return accountCompleteAddress;
     }
     /**
+   * Retrieves the four privacy secret keys PXE holds for a registered account (nullifier-hiding, incoming-viewing,
+   * outgoing-viewing, tagging).
+   *
+   * These do NOT grant control over an account's assets, e.g. they are insufficient to impersonate the account or to
+   * spend notes, but they _do_ guard the account's privacy. Parties that have knowledge of these keys can decrypt all
+   * messages sent to the account, discover all of their on-chain activity, including notes, events, etc.
+   *
+   * Security is paramount when handling these keys, which should itself be a very rare occurrence. Other than exporting
+   * and then importing an account into a separate PXE/wallet, there is typically no need for a wallet to ever access
+   * these keys. Applications should NEVER be given access to them.
+   *
+   * @throws If the account is not registered.
+   */ getAccountSecretKeys(account) {
+        return this.keyStore.getAccountSecretKeys(account);
+    }
+    /**
    * Registers a source from which this PXE derives the tagging secrets it scans for to discover incoming private logs.
    * See {@link TaggingSecretSource} for the meaning of each variant. Does nothing if the source is already registered.
    *
@@ -377,7 +423,10 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
                 wasAdded = await this.#registerSender(source.sender);
                 break;
             case 'arbitrary-secret':
-                wasAdded = await this.#registerArbitrarySecret(source.recipient, source.secret);
+                wasAdded = await this.#registerSharedSecret(source.recipient, 'arbitrary-secret', source.secret);
+                break;
+            case 'handshake':
+                wasAdded = await this.#registerSharedSecret(source.recipient, 'handshake', await this.#deriveHandshakeSecret(source.recipient, source.ephPk));
                 break;
             default:
                 {
@@ -391,7 +440,8 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
         }
     }
     /**
-   * Removes a previously registered tagging secret source. Does nothing if it was not registered.
+   * Removes a previously registered tagging secret source, identified by its registered form (see
+   * {@link getTaggingSecretSources}). Does nothing if it was not registered.
    */ async removeTaggingSecretSource(source) {
         switch(source.kind){
             case 'address-derived':
@@ -402,10 +452,11 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
                     break;
                 }
             case 'arbitrary-secret':
+            case 'handshake':
                 {
-                    const { recipient, secret } = source;
-                    const wasRemoved = await this.taggingSecretSourcesStore.removeSharedSecret(recipient, secret);
-                    this.log.info(wasRemoved ? `Removed shared secret for recipient:\n ${recipient.toString()}` : `Shared secret not registered for recipient:\n ${recipient.toString()}`);
+                    const { kind, recipient, secret } = source;
+                    const wasRemoved = await this.taggingSecretSourcesStore.removeSharedSecret(recipient, kind, secret);
+                    this.log.info(wasRemoved ? `Removed ${kind} shared secret for recipient:\n ${recipient.toString()}` : `No ${kind} shared secret registered for recipient:\n ${recipient.toString()}`);
                     break;
                 }
             default:
@@ -425,8 +476,8 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
                     kind: 'address-derived',
                     sender
                 })),
-            ...secrets.map(({ recipient, secret })=>({
-                    kind: 'arbitrary-secret',
+            ...secrets.map(({ recipient, kind, secret })=>({
+                    kind,
                     recipient,
                     secret
                 }))
@@ -446,15 +497,37 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
         this.log.info(wasAdded ? `Added sender:\n ${address.toString()}` : `Sender:\n "${address.toString()}"\n already registered.`);
         return wasAdded;
     }
-    /** Registers a directly-provided shared secret scoped to a recipient. Returns whether it was newly added. */ async #registerArbitrarySecret(recipient, secret) {
+    /**
+   * Derives the shared secret of a handshake from its ephemeral public key: `S = addressSecret(recipient) * ephPk`,
+   * the same derivation the recipient-side scan uses for handshakes discovered onchain. The ephemeral key is
+   * reconstructed from its x-coordinate with a positive y, matching how the protocol generates it.
+   *
+   * @throws If `ephPk` is not the x-coordinate of a Grumpkin curve point, or if `recipient` is not an account of
+   * this PXE, since the derivation needs its keys.
+   */ async #deriveHandshakeSecret(recipient, ephPk) {
+        let ephPkPoint;
+        try {
+            ephPkPoint = await Point.fromXAndSign(ephPk, true);
+        } catch  {
+            throw new Error(`Ephemeral public key x-coordinate ${ephPk} does not correspond to a Grumpkin curve point.`);
+        }
+        const completeAddress = await this.addressStore.getCompleteAddress(recipient);
+        if (!completeAddress || !await this.keyStore.hasAccount(recipient)) {
+            throw new Error(`Recipient ${recipient} is not an account of this PXE. A handshake's shared secret can only be derived for an account whose keys are held.`);
+        }
+        const ivskM = await this.keyStore.getMasterIncomingViewingSecretKey(recipient);
+        const addressSecret = await computeAddressSecret(await completeAddress.getPreaddress(), ivskM);
+        return deriveEcdhSharedSecretPoint(addressSecret, ephPkPoint);
+    }
+    /** Registers a resolved shared secret scoped to a recipient. Returns whether it was newly added. */ async #registerSharedSecret(recipient, kind, secret) {
         if (!await recipient.isValid()) {
             throw new Error(`Recipient ${recipient} is not valid: it does not correspond to a point on the Grumpkin curve. Cannot register a shared secret for it.`);
         }
         if (secret.isZero() || !secret.isOnCurve()) {
             throw new Error(`Shared secret ${secret} is not a valid non-zero point on the Grumpkin curve.`);
         }
-        const wasAdded = await this.taggingSecretSourcesStore.addSharedSecret(recipient, secret);
-        this.log.info(wasAdded ? `Added shared secret for recipient:\n ${recipient.toString()}` : `Shared secret already registered for recipient:\n ${recipient.toString()}`);
+        const wasAdded = await this.taggingSecretSourcesStore.addSharedSecret(recipient, kind, secret);
+        this.log.info(wasAdded ? `Added ${kind} shared secret for recipient:\n ${recipient.toString()}` : `${kind} shared secret already registered for recipient:\n ${recipient.toString()}`);
         return wasAdded;
     }
     /**
@@ -473,76 +546,34 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
    * @param artifact - The build artifact for the contract class.
    */ async registerContractClass(artifact) {
         const contractClassId = await this.contractStore.addContractArtifact(artifact);
+        // Publishing the artifact's public function signatures to the node is part of "registering a class", so that
+        // node-side debugging works regardless of which entrypoint (registerContractClass or registerContract) was used.
+        const publicFunctionSignatures = artifact.functions.filter((fn)=>fn.functionType === FunctionType.PUBLIC).map((fn)=>decodeFunctionSignature(fn.name, fn.parameters));
+        if (publicFunctionSignatures.length > 0) {
+            await this.nodeDebug?.registerContractFunctionSignatures(publicFunctionSignatures);
+        }
         this.log.info(`Added contract class ${artifact.name} with id ${contractClassId}`);
     }
     /**
-   * Adds deployed contracts to the PXE. Deployed contract information is used to access the
-   * contract code when simulating local transactions. This is automatically called by aztec.js when
-   * deploying a contract. Dapps that wish to interact with contracts already deployed should register
-   * these contracts in their users' PXE through this method.
+   * Registers a deployed contract instance so its private state can be synced and its functions simulated. The
+   * artifact for the class the instance runs must be registered separately via {@link registerContractClass}, before
+   * or after this call; registration performs no validation, so a missing or mismatched artifact only surfaces when
+   * the contract is later simulated. This is automatically called by aztec.js when deploying a contract.
    *
-   * @param contract - A contract instance to register, with an optional artifact which can be omitted if the contract class has already been registered.
-   */ async registerContract(contract) {
-        const { instance } = contract;
-        let { artifact } = contract;
-        if (artifact) {
-            // If the user provides an artifact, validate it against the expected class id and register it
-            const contractClass = await getContractClassFromArtifact(artifact);
-            if (!contractClass.id.equals(instance.currentContractClassId)) {
-                throw new Error(`Artifact does not match expected class id (computed ${contractClass.id} but instance refers to ${instance.currentContractClassId})`);
-            }
-            const computedAddress = await computeContractAddressFromInstance(instance);
-            if (!computedAddress.equals(instance.address)) {
-                throw new Error('Added a contract in which the address does not match the contract instance.');
-            }
-            await this.contractStore.addContractArtifact(artifact, contractClass);
-            const publicFunctionSignatures = artifact.functions.filter((fn)=>fn.functionType === FunctionType.PUBLIC).map((fn)=>decodeFunctionSignature(fn.name, fn.parameters));
-            if (publicFunctionSignatures.length > 0) {
-                await this.nodeDebug?.registerContractFunctionSignatures(publicFunctionSignatures);
-            }
-        } else {
-            // Otherwise, make sure there is an artifact already registered for that class id
-            artifact = await this.contractStore.getContractArtifact(instance.currentContractClassId);
-            if (!artifact) {
-                throw new Error(`Artifact not found when registering an instance. Contract class: ${instance.currentContractClassId}.`);
-            }
-        }
-        await this.contractStore.addContractInstance(instance);
-        this.log.info(`Added contract ${artifact.name} at ${instance.address.toString()} with class ${instance.currentContractClassId}`);
-    }
-    /**
-   * Updates a deployed contract in the PXE. This is used to update the contract artifact when
-   * an update has happened, so the new code can be used in the simulation of local transactions.
-   * This is called by aztec.js when instantiating a contract in a given address with a mismatching artifact.
-   * @param contractAddress - The address of the contract to update.
-   * @param artifact - The updated artifact for the contract.
-   * @throws If the artifact's contract class is not found in the PXE or if the contract class is different from
-   * the current one (current one from the point of view of the node to which the PXE is connected).
-   */ updateContract(contractAddress, artifact) {
-        // We disable concurrently updating contracts to avoid concurrently syncing with the node, or changing a contract's
-        // class while we're simulating it.
+   * @param instance - The address preimage of the contract instance to register. The address is derived from it.
+   * @returns The address of the registered instance.
+   */ registerContract(instance) {
+        // Run inside the job queue so we can't race a concurrent simulation while writing the instance to the store.
         return this.#putInJobQueue(async ()=>{
-            const currentInstance = await this.contractStore.getContractInstance(contractAddress);
-            if (!currentInstance) {
-                throw new Error(`Instance not found when updating a contract. Contract address: ${contractAddress}.`);
-            }
-            const contractClass = await getContractClassFromArtifact(artifact);
-            await this.#maybeSync();
-            const header = await this.anchorBlockStore.getBlockHeader();
-            const currentClassId = await readCurrentClassId(contractAddress, currentInstance, this.node, header);
-            if (!contractClass.id.equals(currentClassId)) {
-                throw new Error('Could not update contract to a class different from the current one.');
-            }
-            const publicFunctionSignatures = artifact.functions.filter((fn)=>fn.functionType === FunctionType.PUBLIC).map((fn)=>decodeFunctionSignature(fn.name, fn.parameters));
-            if (publicFunctionSignatures.length > 0) {
-                await this.nodeDebug?.registerContractFunctionSignatures(publicFunctionSignatures);
-            }
-            currentInstance.currentContractClassId = contractClass.id;
-            await Promise.all([
-                this.contractStore.addContractArtifact(artifact, contractClass),
-                this.contractStore.addContractInstance(currentInstance)
-            ]);
-            this.log.info(`Updated contract ${artifact.name} at ${contractAddress.toString()} to class ${contractClass.id}`);
+            const address = await computeContractAddressFromInstance(instance);
+            await this.contractStore.addContractInstance({
+                ...instance,
+                address
+            });
+            this.log.info(`Added contract at ${address}`, {
+                address
+            });
+            return address;
         });
     }
     /**
@@ -736,7 +767,7 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
                 let publicInputs;
                 let executionSteps = [];
                 if (skipKernels) {
-                    ({ publicInputs, executionSteps } = await generateSimulatedProvingResult(privateExecutionResult, (addr, sel)=>this.contractStore.getDebugFunctionName(addr, sel), this.node));
+                    ({ publicInputs, executionSteps } = await generateSimulatedProvingResult(privateExecutionResult, (addr, sel)=>this.#getDebugFunctionName(addr, sel, anchorBlockHeader), this.node));
                 } else {
                     // Kernel logic, plus proving of all private functions and kernels.
                     ({ publicInputs, executionSteps } = await this.#prove(txRequest, this.proofCreator, privateExecutionResult, anchorBlockHeader, {
@@ -754,7 +785,7 @@ import { persistSenderTaggingIndexRangesForTx } from './tagging/index.js';
                     publicOutput = await this.#simulatePublicCalls(simulatedTx, skipFeeEnforcement, overrides);
                     publicSimulationTime = publicSimulationTimer.ms();
                     if (publicOutput?.debugLogs?.length) {
-                        await displayDebugLogs(publicOutput.debugLogs, (addr)=>this.contractStore.getDebugContractName(addr));
+                        await displayDebugLogs(publicOutput.debugLogs, (addr)=>this.#getDebugContractName(addr, anchorBlockHeader));
                     }
                 }
                 let validationTime;

package/dest/storage/backwards_compatibility_tests/schema_tests.d.ts

@@ -12,4 +12,4 @@ export type SchemaTest = {
     snapshotStore: (kvStore: AztecAsyncKVStore) => Promise<Record<string, unknown>>;
 };
 export declare const SCHEMA_TESTS: readonly SchemaTest[];
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hX3Rlc3RzLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvc3RvcmFnZS9iYWNrd2FyZHNfY29tcGF0aWJpbGl0eV90ZXN0cy9zY2hlbWFfdGVzdHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBUUEsT0FBTyxLQUFLLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQXlDekQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxNQUFNLFVBQVUsR0FBRztJQUN2QixJQUFJLEVBQUUsTUFBTSxDQUFDO0lBQ2IsWUFBWSxFQUFFLENBQUMsT0FBTyxFQUFFLGlCQUFpQixLQUFLLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM1RCxhQUFhLEVBQUUsQ0FBQyxPQUFPLEVBQUUsaUJBQWlCLEtBQUssT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztDQUNqRixDQUFDO0FBRUYsZUFBTyxNQUFNLFlBQVksRUFBRSxTQUFTLFVBQVUsRUEwakI3QyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hX3Rlc3RzLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvc3RvcmFnZS9iYWNrd2FyZHNfY29tcGF0aWJpbGl0eV90ZXN0cy9zY2hlbWFfdGVzdHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBUUEsT0FBTyxLQUFLLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQTBDekQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxNQUFNLFVBQVUsR0FBRztJQUN2QixJQUFJLEVBQUUsTUFBTSxDQUFDO0lBQ2IsWUFBWSxFQUFFLENBQUMsT0FBTyxFQUFFLGlCQUFpQixLQUFLLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM1RCxhQUFhLEVBQUUsQ0FBQyxPQUFPLEVBQUUsaUJBQWlCLEtBQUssT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztDQUNqRixDQUFDO0FBRUYsZUFBTyxNQUFNLFlBQVksRUFBRSxTQUFTLFVBQVUsRUEybEI3QyxDQUFDIn0=

package/dest/storage/backwards_compatibility_tests/schema_tests.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_tests.d.ts","sourceRoot":"","sources":["../../../src/storage/backwards_compatibility_tests/schema_tests.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAyCzD;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,aAAa,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjF,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EA0jB7C,CAAC"}
+{"version":3,"file":"schema_tests.d.ts","sourceRoot":"","sources":["../../../src/storage/backwards_compatibility_tests/schema_tests.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AA0CzD;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,aAAa,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjF,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EA2lB7C,CAAC"}

package/dest/storage/backwards_compatibility_tests/schema_tests.js

@@ -12,8 +12,8 @@ import { BlockHash, Body, GENESIS_BLOCK_HEADER_HASH, L2Block } from '@aztec/stdl
 import { Checkpoint, L1PublishedData, PublishedCheckpoint } from '@aztec/stdlib/checkpoint';
 import { CompleteAddress, SerializableContractInstance } from '@aztec/stdlib/contract';
 import { GasFees } from '@aztec/stdlib/gas';
-import { PublicKey, PublicKeys } from '@aztec/stdlib/keys';
-import { AppTaggingSecret, ContractClassLog, ContractClassLogFields, PrivateLog, PublicLog } from '@aztec/stdlib/logs';
+import { PublicKey, PublicKeys, deriveKeys } from '@aztec/stdlib/keys';
+import { AppTaggingSecret, AppTaggingSecretKind, ContractClassLog, ContractClassLogFields, PrivateLog, PublicLog } from '@aztec/stdlib/logs';
 import { Note, NoteDao } from '@aztec/stdlib/note';
 import { CheckpointHeader } from '@aztec/stdlib/rollup';
 import { AppendOnlyTreeSnapshot } from '@aztec/stdlib/trees';
@@ -194,7 +194,7 @@ export const SCHEMA_TESTS = [
         name: 'KeyStore',
         writeToStore: async (kvStore)=>{
             const keyStore = new KeyStore(kvStore);
-            await keyStore.addAccount(new Fr(2n), new Fr(3n));
+            await keyStore.addAccount(await deriveKeys(new Fr(2n)), new Fr(3n));
         },
         snapshotStore: async (kvStore)=>({
                 key_store: await snapshotMap(kvStore.openMap('key_store'))
@@ -399,9 +399,13 @@ export const SCHEMA_TESTS = [
             const jobId = 'fixture-job';
             const secretA = new AppTaggingSecret(new Fr(2n), AztecAddress.fromBigIntUnsafe(3n));
             const secretB = new AppTaggingSecret(new Fr(5n), AztecAddress.fromBigIntUnsafe(7n));
+            // A constrained secret keys under the `constrained:` prefix, so the snapshot pins both kinds side by side.
+            const secretConstrained = new AppTaggingSecret(new Fr(19n), AztecAddress.fromBigIntUnsafe(23n), AppTaggingSecretKind.CONSTRAINED);
             await recipientTaggingStore.updateHighestFinalizedIndex(secretA, 11, jobId);
             await recipientTaggingStore.updateHighestAgedIndex(secretA, 13, jobId);
             await recipientTaggingStore.updateHighestFinalizedIndex(secretB, 17, jobId);
+            await recipientTaggingStore.updateHighestFinalizedIndex(secretConstrained, 11, jobId);
+            await recipientTaggingStore.updateHighestAgedIndex(secretConstrained, 13, jobId);
             await kvStore.transactionAsync(()=>recipientTaggingStore.commit(jobId));
         },
         snapshotStore: async (kvStore)=>({
@@ -416,9 +420,9 @@ export const SCHEMA_TESTS = [
             await taggingSecretSourcesStore.addSender(AztecAddress.fromBigIntUnsafe(2n));
             await taggingSecretSourcesStore.addSender(AztecAddress.fromBigIntUnsafe(3n));
             await taggingSecretSourcesStore.addSender(AztecAddress.fromBigIntUnsafe(5n));
-            await taggingSecretSourcesStore.addSharedSecret(AztecAddress.fromBigIntUnsafe(7n), new Point(new Fr(2n), new Fr(3n)));
-            await taggingSecretSourcesStore.addSharedSecret(AztecAddress.fromBigIntUnsafe(7n), new Point(new Fr(5n), new Fr(7n)));
-            await taggingSecretSourcesStore.addSharedSecret(AztecAddress.fromBigIntUnsafe(11n), new Point(new Fr(13n), new Fr(17n)));
+            await taggingSecretSourcesStore.addSharedSecret(AztecAddress.fromBigIntUnsafe(7n), 'arbitrary-secret', new Point(new Fr(2n), new Fr(3n)));
+            await taggingSecretSourcesStore.addSharedSecret(AztecAddress.fromBigIntUnsafe(7n), 'handshake', new Point(new Fr(5n), new Fr(7n)));
+            await taggingSecretSourcesStore.addSharedSecret(AztecAddress.fromBigIntUnsafe(11n), 'arbitrary-secret', new Point(new Fr(13n), new Fr(17n)));
         },
         snapshotStore: async (kvStore)=>({
                 senders: await snapshotMap(kvStore.openMap('senders')),
@@ -433,10 +437,13 @@ export const SCHEMA_TESTS = [
             const secretA = new AppTaggingSecret(new Fr(2n), AztecAddress.fromBigIntUnsafe(3n));
             const secretB = new AppTaggingSecret(new Fr(5n), AztecAddress.fromBigIntUnsafe(7n));
             const secretC = new AppTaggingSecret(new Fr(11n), AztecAddress.fromBigIntUnsafe(13n));
+            const secretConstrained = new AppTaggingSecret(new Fr(19n), AztecAddress.fromBigIntUnsafe(23n), AppTaggingSecretKind.CONSTRAINED);
             const txHashA = TxHash.fromBigInt(17n);
             const txHashB = TxHash.fromBigInt(19n);
             const txHashC = TxHash.fromBigInt(23n);
             const txHashD = TxHash.fromBigInt(29n);
+            const txHashE = TxHash.fromBigInt(31n);
+            const txHashF = TxHash.fromBigInt(37n);
             // secretA receives three pending ranges (one per tx); secretB receives one. After finalizing txHashA below,
             // secretA's array shrinks to two elements (the txHashB and txHashC ranges, both with highestIndex > 3) which
             // pins the multi-element JSON encoding of `pending_indexes`.
@@ -485,8 +492,25 @@ export const SCHEMA_TESTS = [
                     highestIndex: 9
                 }
             ], txHashD, jobId);
+            // secretConstrained gets a finalized range (txHashE) plus a surviving higher pending range (txHashF), so the
+            // `constrained:` key lands in both pending_indexes and last_finalized_indexes.
+            await senderTaggingStore.storePendingIndexes([
+                {
+                    extendedSecret: secretConstrained,
+                    lowestIndex: 1,
+                    highestIndex: 3
+                }
+            ], txHashE, jobId);
+            await senderTaggingStore.storePendingIndexes([
+                {
+                    extendedSecret: secretConstrained,
+                    lowestIndex: 4,
+                    highestIndex: 7
+                }
+            ], txHashF, jobId);
             await senderTaggingStore.finalizePendingIndexes([
-                txHashA
+                txHashA,
+                txHashE
             ], jobId);
             await kvStore.transactionAsync(()=>senderTaggingStore.commit(jobId));
         },