@aztec/txe 0.0.1-commit.3100065 → 0.0.1-commit.321f6a9

package/dest/oracle/txe_oracle_top_level_context.js

@@ -1,3 +1,68 @@
+function _ts_add_disposable_resource(env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() {
+            try {
+                inner.call(this);
+            } catch (e) {
+                return Promise.reject(e);
+            }
+        };
+        env.stack.push({
+            value: value,
+            dispose: dispose,
+            async: async
+        });
+    } else if (async) {
+        env.stack.push({
+            async: true
+        });
+    }
+    return value;
+}
+function _ts_dispose_resources(env) {
+    var _SuppressedError = typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed, message) {
+        var e = new Error(message);
+        return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+    };
+    return (_ts_dispose_resources = function _ts_dispose_resources(env) {
+        function fail(e) {
+            env.error = env.hasError ? new _SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while(r = env.stack.pop()){
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) {
+                            fail(e);
+                            return next();
+                        });
+                    } else s |= 1;
+                } catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    })(env);
+}
 import { CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS, MAX_PRIVATE_LOGS_PER_TX, NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP } from '@aztec/constants';
 import { BlockNumber } from '@aztec/foundation/branded-types';
 import { Schnorr } from '@aztec/foundation/crypto/schnorr';
@@ -7,7 +72,7 @@ import { TestDateProvider } from '@aztec/foundation/timer';
 import { AnchoredContractData, CapsuleService, FactService, ORACLE_VERSION_MAJOR, composeHooks, enrichPublicSimulationError } from '@aztec/pxe/server';
 import { CONTRACT_INSTANCE, ExecutionNoteCache, ExecutionTaggingIndexCache, HashedValuesCache, PrivateExecutionOracle, TransientArrayService, UtilityExecutionOracle, buildACIRCallback, executePrivateFunction, generateSimulatedProvingResult } from '@aztec/pxe/simulator';
 import { ExecutionError, WASMSimulator, createSimulationError, extractCallStack, resolveAssertionMessageFromError, toACVMWitness, witnessMapToFields } from '@aztec/simulator/client';
-import { CppPublicTxSimulator, GuardedMerkleTreeOperations, PublicContractsDB, PublicProcessor } from '@aztec/simulator/server';
+import { GuardedMerkleTreeOperations, PublicContractsDB, PublicProcessor, PublicTxSimulator } from '@aztec/simulator/server';
 import { FunctionCall, FunctionSelector, FunctionType } from '@aztec/stdlib/abi';
 import { AuthWitness } from '@aztec/stdlib/auth-witness';
 import { PublicSimulatorConfig } from '@aztec/stdlib/avm';
@@ -46,13 +111,14 @@ export class TXEOracleTopLevelContext {
     chainId;
     authwits;
     taggingSecretStrategies;
+    authorizeAllUtilityCallTargets;
     artifactResolver;
     rootPath;
     packageName;
     isMisc;
     isTxe;
     logger;
-    constructor(stateMachine, contractStore, noteStore, keyStore, addressStore, accountStore, senderTaggingStore, recipientTaggingStore, taggingSecretSourcesStore, capsuleStore, factStore, privateEventStore, nextBlockTimestamp, version, chainId, authwits, taggingSecretStrategies, artifactResolver, rootPath, packageName){
+    constructor(stateMachine, contractStore, noteStore, keyStore, addressStore, accountStore, senderTaggingStore, recipientTaggingStore, taggingSecretSourcesStore, capsuleStore, factStore, privateEventStore, nextBlockTimestamp, version, chainId, authwits, taggingSecretStrategies, authorizeAllUtilityCallTargets, artifactResolver, rootPath, packageName){
         this.stateMachine = stateMachine;
         this.contractStore = contractStore;
         this.noteStore = noteStore;
@@ -70,6 +136,7 @@ export class TXEOracleTopLevelContext {
         this.chainId = chainId;
         this.authwits = authwits;
         this.taggingSecretStrategies = taggingSecretStrategies;
+        this.authorizeAllUtilityCallTargets = authorizeAllUtilityCallTargets;
         this.artifactResolver = artifactResolver;
         this.rootPath = rootPath;
         this.packageName = packageName;
@@ -235,9 +302,8 @@ export class TXEOracleTopLevelContext {
         this.logger.debug(`Created account ${completeAddress.address}`);
         return completeAddress;
     }
-    async createAccount(secret) {
-        // This is a foot gun !
-        const completeAddress = await this.keyStore.addAccount(await deriveKeys(secret), secret);
+    async createAccount(secret, partialAddress) {
+        const completeAddress = await this.keyStore.addAccount(await deriveKeys(secret), partialAddress);
         await this.accountStore.setAccount(completeAddress.address, completeAddress);
         await this.addressStore.addCompleteAddress(completeAddress);
         this.logger.debug(`Created account ${completeAddress.address}`);
@@ -263,6 +329,9 @@ export class TXEOracleTopLevelContext {
         apply(AppTaggingSecretKind.UNCONSTRAINED, unconstrainedStrategy);
         apply(AppTaggingSecretKind.CONSTRAINED, constrainedStrategy);
     }
+    setAuthorizeAllUtilityCallTargets(authorizeAll) {
+        this.authorizeAllUtilityCallTargets = authorizeAll;
+    }
     async sendL1ToL2Message(content, secretHash, sender, recipient) {
         // Messages are appended to the tree, so the next free slot is simply the current tree size.
         const { size } = await this.stateMachine.synchronizer.getCommitted().getTreeInfo(MerkleTreeId.L1_TO_L2_MESSAGE_TREE);
@@ -299,277 +368,302 @@ export class TXEOracleTopLevelContext {
         await this.stateMachine.handleL2Block(block, options.l1ToL2Messages ?? []);
     }
     async privateCallNewFlow(from, targetContractAddress = AztecAddress.zero(), functionSelector = FunctionSelector.empty(), args, argsHash = Fr.zero(), isStaticCall = false, additionalScopes = [], jobId, authorizedUtilityCallTargets, gasSettings) {
-        const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
-        const anchoredContractData = new AnchoredContractData(this.contractStore, this.stateMachine.contractClassService, blockHeader);
-        this.logger.verbose(`Executing external function ${await anchoredContractData.getDebugFunctionName(targetContractAddress, functionSelector)}@${targetContractAddress} isStaticCall=${isStaticCall}`);
-        const artifact = await anchoredContractData.getFunctionArtifact(targetContractAddress, functionSelector);
-        if (!artifact) {
-            const message = functionSelector.equals(await FunctionSelector.fromSignature('verify_private_authwit(Field)')) ? 'Found no account contract artifact for a private authwit check - use `create_contract_account` instead of `create_light_account` for authwit support.' : 'Function Artifact does not exist';
-            throw new Error(message);
-        }
-        const scopes = from === undefined ? additionalScopes : [
-            from,
-            ...additionalScopes
-        ];
-        // Sync notes before executing private function to discover notes from previous transactions
-        const utilityExecutor = async (call, execScopes)=>{
-            await this.executeUtilityCall(call, {
-                scopes: execScopes,
-                jobId
-            });
+        const env = {
+            stack: [],
+            error: void 0,
+            hasError: false
         };
-        await this.stateMachine.contractSyncService.ensureContractSynced(targetContractAddress, functionSelector, utilityExecutor, blockHeader, jobId, scopes);
-        const blockNumber = await this.getNextBlockNumber();
-        const msgSender = from ?? AztecAddress.NULL_MSG_SENDER;
-        const callContext = new CallContext(msgSender, targetContractAddress, functionSelector, isStaticCall);
-        const txContext = new TxContext(this.chainId, this.version, gasSettings);
-        const protocolNullifier = await computeProtocolNullifier(getSingleTxBlockRequestHash(blockNumber));
-        const noteCache = new ExecutionNoteCache(protocolNullifier);
-        // In production, the account contract sets the min revertible counter before calling the app function.
-        // Since TXE bypasses the account contract, we simulate this by setting minRevertibleSideEffectCounter to 1,
-        // marking all side effects as revertible.
-        const minRevertibleSideEffectCounter = 1;
-        await noteCache.setMinRevertibleSideEffectCounter(minRevertibleSideEffectCounter);
-        const taggingIndexCache = new ExecutionTaggingIndexCache();
-        const simulator = new WASMSimulator();
-        const transientArrayService = new TransientArrayService();
-        const privateExecutionOracle = new PrivateExecutionOracle({
-            argsHash,
-            txContext,
-            // The TXE does not run the init kernel's salt binding, so no tx-request salt is in scope.
-            txRequestSalt: Fr.ZERO,
-            callContext,
-            anchorBlockHeader: blockHeader,
-            utilityExecutor,
-            authWitnesses: Array.from(this.authwits.values()),
-            capsules: [],
-            executionCache: HashedValuesCache.create([
-                new HashedValues(args, argsHash)
-            ]),
-            noteCache,
-            taggingIndexCache,
-            anchoredContractData,
-            noteStore: this.noteStore,
-            keyStore: this.keyStore,
-            addressStore: this.addressStore,
-            aztecNode: this.stateMachine.node,
-            senderTaggingStore: this.senderTaggingStore,
-            recipientTaggingStore: this.recipientTaggingStore,
-            taggingSecretSourcesStore: this.taggingSecretSourcesStore,
-            capsuleService: new CapsuleService(this.capsuleStore, scopes),
-            factService: new FactService(this.factStore, scopes),
-            privateEventStore: this.privateEventStore,
-            contractSyncService: this.stateMachine.contractSyncService,
-            jobId,
-            totalPublicCalldataCount: 0,
-            sideEffectCounter: minRevertibleSideEffectCounter,
-            scopes,
-            // In TXE, the typical transaction entrypoint is skipped, so we need to simulate the actions that such a
-            // contract would perform, including setting senderForTags.
-            senderForTags: from,
-            simulator,
-            txResolver: this.stateMachine.txResolver,
-            l2TipsStore: this.stateMachine.l2TipsProvider,
-            hooks: composeHooks({
-                authorizeUtilityCall: this.buildAuthorizeUtilityCallHook(isStaticCall ? 'private view' : 'private', authorizedUtilityCallTargets),
-                resolveTaggingSecretStrategy: makeResolveTaggingSecretStrategyHook(this.taggingSecretStrategies)
-            }),
-            transientArrayService
-        });
-        // Note: This is a slight modification of simulator.run without any of the checks. Maybe we should modify simulator.run with a boolean value to skip checks.
-        let result;
-        let executionResult;
         try {
-            executionResult = await executePrivateFunction(simulator, privateExecutionOracle, artifact, targetContractAddress, functionSelector);
-            const publicCallRequests = collectNested([
+            const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+            const anchoredContractData = new AnchoredContractData(this.contractStore, this.stateMachine.contractClassService, blockHeader);
+            this.logger.verbose(`Executing external function ${await anchoredContractData.getDebugFunctionName(targetContractAddress, functionSelector)}@${targetContractAddress} isStaticCall=${isStaticCall}`);
+            const artifact = await anchoredContractData.getFunctionArtifact(targetContractAddress, functionSelector);
+            if (!artifact) {
+                const message = functionSelector.equals(await FunctionSelector.fromSignature('verify_private_authwit(Field)')) ? 'Found no account contract artifact for a private authwit check - use `create_contract_account` instead of `create_light_account` for authwit support.' : 'Function Artifact does not exist';
+                throw new Error(message);
+            }
+            const scopes = from === undefined ? additionalScopes : [
+                from,
+                ...additionalScopes
+            ];
+            // Sync notes before executing private function to discover notes from previous transactions
+            const utilityExecutor = async (call, execScopes)=>{
+                await this.executeUtilityCall(call, {
+                    scopes: execScopes,
+                    jobId
+                });
+            };
+            await this.stateMachine.contractSyncService.ensureContractSynced(targetContractAddress, functionSelector, utilityExecutor, blockHeader, jobId, scopes);
+            const blockNumber = await this.getNextBlockNumber();
+            const msgSender = from ?? AztecAddress.NULL_MSG_SENDER;
+            const callContext = new CallContext(msgSender, targetContractAddress, functionSelector, isStaticCall);
+            const txContext = new TxContext(this.chainId, this.version, gasSettings);
+            const protocolNullifier = await computeProtocolNullifier(getSingleTxBlockRequestHash(blockNumber));
+            const noteCache = new ExecutionNoteCache(protocolNullifier);
+            // In production, the account contract sets the min revertible counter before calling the app function.
+            // Since TXE bypasses the account contract, we simulate this by setting minRevertibleSideEffectCounter to 1,
+            // marking all side effects as revertible.
+            const minRevertibleSideEffectCounter = 1;
+            await noteCache.setMinRevertibleSideEffectCounter(minRevertibleSideEffectCounter);
+            const taggingIndexCache = new ExecutionTaggingIndexCache();
+            const simulator = new WASMSimulator();
+            const transientArrayService = new TransientArrayService();
+            const privateExecutionOracle = new PrivateExecutionOracle({
+                argsHash,
+                txContext,
+                txRequestSalt: Fr.ZERO,
+                callContext,
+                anchorBlockHeader: blockHeader,
+                utilityExecutor,
+                authWitnesses: Array.from(this.authwits.values()),
+                capsules: [],
+                executionCache: HashedValuesCache.create([
+                    new HashedValues(args, argsHash)
+                ]),
+                noteCache,
+                taggingIndexCache,
+                anchoredContractData,
+                noteStore: this.noteStore,
+                keyStore: this.keyStore,
+                addressStore: this.addressStore,
+                aztecNode: this.stateMachine.node,
+                senderTaggingStore: this.senderTaggingStore,
+                recipientTaggingStore: this.recipientTaggingStore,
+                taggingSecretSourcesStore: this.taggingSecretSourcesStore,
+                capsuleService: new CapsuleService(this.capsuleStore, scopes),
+                factService: new FactService(this.factStore, scopes),
+                privateEventStore: this.privateEventStore,
+                contractSyncService: this.stateMachine.contractSyncService,
+                jobId,
+                totalPublicCalldataCount: 0,
+                sideEffectCounter: minRevertibleSideEffectCounter,
+                scopes,
+                // In TXE, the typical transaction entrypoint is skipped, so we need to simulate the actions that such a
+                // contract would perform, including setting senderForTags.
+                senderForTags: from,
+                simulator,
+                txResolver: this.stateMachine.txResolver,
+                l2TipsStore: this.stateMachine.l2TipsProvider,
+                hooks: composeHooks({
+                    authorizeUtilityCall: this.buildAuthorizeUtilityCallHook(isStaticCall ? 'private view' : 'private', authorizedUtilityCallTargets),
+                    resolveTaggingSecretStrategy: makeResolveTaggingSecretStrategyHook(this.taggingSecretStrategies)
+                }),
+                transientArrayService
+            });
+            // Note: This is a slight modification of simulator.run without any of the checks. Maybe we should modify simulator.run with a boolean value to skip checks.
+            let result;
+            let executionResult;
+            try {
+                executionResult = await executePrivateFunction(simulator, privateExecutionOracle, artifact, targetContractAddress, functionSelector);
+                const publicCallRequests = collectNested([
+                    executionResult
+                ], (r)=>r.publicInputs.publicCallRequests.getActiveItems().map((r)=>r.inner).concat(r.publicInputs.publicTeardownCallRequest.isEmpty() ? [] : [
+                        r.publicInputs.publicTeardownCallRequest
+                    ]));
+                const publicFunctionsCalldata = await Promise.all(publicCallRequests.map(async (r)=>{
+                    const calldata = await privateExecutionOracle.getHashPreimage(r.calldataHash);
+                    return new HashedValues(calldata, r.calldataHash);
+                }));
+                const nonceGenerator = noteCache.getNonceGenerator();
+                result = new PrivateExecutionResult(executionResult, nonceGenerator, publicFunctionsCalldata);
+            } catch (err) {
+                throw createSimulationError(err instanceof Error ? err : new Error('Unknown error during private execution'));
+            }
+            // According to the protocol rules, there must be at least one nullifier in the tx. The first nullifier is used as
+            // the nonce generator for the note hashes.
+            // We pass the non-zero minRevertibleSideEffectCounter to make sure the side effects are split correctly.
+            const { publicInputs } = await generateSimulatedProvingResult(result, (addr, sel)=>anchoredContractData.getDebugFunctionName(addr, sel), this.stateMachine.node, minRevertibleSideEffectCounter);
+            const globals = makeGlobalVariables();
+            globals.blockNumber = blockNumber;
+            globals.timestamp = this.nextBlockTimestamp;
+            globals.chainId = this.chainId;
+            globals.version = this.version;
+            globals.gasFees = GasFees.empty();
+            const forkedWorldTrees = _ts_add_disposable_resource(env, await this.stateMachine.synchronizer.nativeWorldStateService.fork(), true);
+            const bindings = this.logger.getBindings();
+            const contractsDB = new PublicContractsDB(new TXEPublicContractDataSource(blockNumber, this.contractStore), bindings);
+            const guardedMerkleTrees = new GuardedMerkleTreeOperations(forkedWorldTrees);
+            const config = PublicSimulatorConfig.from({
+                skipFeeEnforcement: true,
+                collectDebugLogs: true,
+                collectHints: false,
+                collectStatistics: false,
+                collectCallMetadata: true
+            });
+            // The AVM simulator reads this fork's contracts DB, scoped by fork id, for each simulation.
+            const forkId = forkedWorldTrees.getRevision().forkId;
+            const processor = new PublicProcessor(globals, guardedMerkleTrees, contractsDB, new PublicTxSimulator(this.stateMachine.synchronizer.avmSimulator, globals, contractsDB, forkId, config, bindings), new TestDateProvider(), undefined, createLogger('simulator:public-processor', bindings));
+            const tx = await Tx.create({
+                data: publicInputs,
+                chonkProof: ChonkProof.empty(),
+                contractClassLogFields: [],
+                publicFunctionCalldata: result.publicFunctionCalldata
+            });
+            let checkpoint;
+            if (isStaticCall) {
+                checkpoint = await ForkCheckpoint.new(forkedWorldTrees);
+            }
+            const results = await processor.process([
+                tx
+            ]);
+            const [processedTx] = results[0];
+            const failedTxs = results[1];
+            if (failedTxs.length !== 0) {
+                throw new Error(`Public execution has failed: ${failedTxs[0].error}`);
+            } else if (!processedTx.revertCode.isOK()) {
+                if (processedTx.revertReason) {
+                    try {
+                        await enrichPublicSimulationError(processedTx.revertReason, this.contractStore, this.stateMachine.contractClassService, await this.stateMachine.anchorBlockStore.getBlockHeader(), this.logger);
+                    // eslint-disable-next-line no-empty
+                    } catch  {}
+                    throw new Error(`Contract execution has reverted: ${processedTx.revertReason.getMessage()}`);
+                } else {
+                    throw new Error('Contract execution has reverted');
+                }
+            }
+            // Walk the nested private-call tree and collect every offchain effect the transaction emitted.
+            // PXE stores these on each `PrivateCallExecutionResult` and they never reach TXE via the
+            // `aztec_utl_emitOffchainEffect` foreign-call path (that path only fires at the top-level), so
+            // we pull them out here and the RPC wrapper will hand them to `TXESession` for buffering.
+            const offchainEffects = collectNested([
                 executionResult
-            ], (r)=>r.publicInputs.publicCallRequests.getActiveItems().map((r)=>r.inner).concat(r.publicInputs.publicTeardownCallRequest.isEmpty() ? [] : [
-                    r.publicInputs.publicTeardownCallRequest
-                ]));
-            const publicFunctionsCalldata = await Promise.all(publicCallRequests.map(async (r)=>{
-                const calldata = await privateExecutionOracle.getHashPreimage(r.calldataHash);
-                return new HashedValues(calldata, r.calldataHash);
-            }));
-            const nonceGenerator = noteCache.getNonceGenerator();
-            result = new PrivateExecutionResult(executionResult, nonceGenerator, publicFunctionsCalldata);
-        } catch (err) {
-            throw createSimulationError(err instanceof Error ? err : new Error('Unknown error during private execution'));
-        }
-        // According to the protocol rules, there must be at least one nullifier in the tx. The first nullifier is used as
-        // the nonce generator for the note hashes.
-        // We pass the non-zero minRevertibleSideEffectCounter to make sure the side effects are split correctly.
-        const { publicInputs } = await generateSimulatedProvingResult(result, (addr, sel)=>anchoredContractData.getDebugFunctionName(addr, sel), this.stateMachine.node, minRevertibleSideEffectCounter);
-        const globals = makeGlobalVariables();
-        globals.blockNumber = blockNumber;
-        globals.timestamp = this.nextBlockTimestamp;
-        globals.chainId = this.chainId;
-        globals.version = this.version;
-        globals.gasFees = GasFees.empty();
-        const forkedWorldTrees = await this.stateMachine.synchronizer.nativeWorldStateService.fork();
-        const bindings = this.logger.getBindings();
-        const contractsDB = new PublicContractsDB(new TXEPublicContractDataSource(blockNumber, this.contractStore), bindings);
-        const guardedMerkleTrees = new GuardedMerkleTreeOperations(forkedWorldTrees);
-        const config = PublicSimulatorConfig.from({
-            skipFeeEnforcement: true,
-            collectDebugLogs: true,
-            collectHints: false,
-            collectStatistics: false,
-            collectCallMetadata: true
-        });
-        const processor = new PublicProcessor(globals, guardedMerkleTrees, contractsDB, new CppPublicTxSimulator(guardedMerkleTrees, contractsDB, globals, config, bindings), new TestDateProvider(), undefined, createLogger('simulator:public-processor', bindings));
-        const tx = await Tx.create({
-            data: publicInputs,
-            chonkProof: ChonkProof.empty(),
-            contractClassLogFields: [],
-            publicFunctionCalldata: result.publicFunctionCalldata
-        });
-        let checkpoint;
-        if (isStaticCall) {
-            checkpoint = await ForkCheckpoint.new(forkedWorldTrees);
-        }
-        const results = await processor.process([
-            tx
-        ]);
-        const [processedTx] = results[0];
-        const failedTxs = results[1];
-        if (failedTxs.length !== 0) {
-            throw new Error(`Public execution has failed: ${failedTxs[0].error}`);
-        } else if (!processedTx.revertCode.isOK()) {
-            if (processedTx.revertReason) {
-                try {
-                    await enrichPublicSimulationError(processedTx.revertReason, this.contractStore, this.stateMachine.contractClassService, await this.stateMachine.anchorBlockStore.getBlockHeader(), this.logger);
-                // eslint-disable-next-line no-empty
-                } catch  {}
-                throw new Error(`Contract execution has reverted: ${processedTx.revertReason.getMessage()}`);
-            } else {
-                throw new Error('Contract execution has reverted');
+            ], (r)=>r.offchainEffects.map((e)=>e.data));
+            if (isStaticCall) {
+                await checkpoint.revert();
+                return {
+                    returnValues: executionResult.returnValues ?? [],
+                    offchainEffects
+                };
             }
-        }
-        // Walk the nested private-call tree and collect every offchain effect the transaction emitted.
-        // PXE stores these on each `PrivateCallExecutionResult` and they never reach TXE via the
-        // `aztec_utl_emitOffchainEffect` foreign-call path (that path only fires at the top-level), so
-        // we pull them out here and the RPC wrapper will hand them to `TXESession` for buffering.
-        const offchainEffects = collectNested([
-            executionResult
-        ], (r)=>r.offchainEffects.map((e)=>e.data));
-        if (isStaticCall) {
-            await checkpoint.revert();
-            await forkedWorldTrees.close();
+            const txEffect = TxEffect.empty();
+            txEffect.noteHashes = processedTx.txEffect.noteHashes;
+            txEffect.nullifiers = processedTx.txEffect.nullifiers;
+            txEffect.privateLogs = processedTx.txEffect.privateLogs;
+            txEffect.publicLogs = processedTx.txEffect.publicLogs;
+            txEffect.publicDataWrites = processedTx.txEffect.publicDataWrites;
+            txEffect.txHash = new TxHash(new Fr(blockNumber));
+            const l1ToL2Messages = Array(NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP).fill(0).map(Fr.zero);
+            await forkedWorldTrees.appendLeaves(MerkleTreeId.L1_TO_L2_MESSAGE_TREE, l1ToL2Messages);
+            const l2Block = await makeTXEBlock(forkedWorldTrees, globals, [
+                txEffect
+            ]);
+            await this.stateMachine.handleL2Block(l2Block);
             return {
                 returnValues: executionResult.returnValues ?? [],
                 offchainEffects
             };
+        } catch (e) {
+            env.error = e;
+            env.hasError = true;
+        } finally{
+            const result = _ts_dispose_resources(env);
+            if (result) await result;
         }
-        const txEffect = TxEffect.empty();
-        txEffect.noteHashes = processedTx.txEffect.noteHashes;
-        txEffect.nullifiers = processedTx.txEffect.nullifiers;
-        txEffect.privateLogs = processedTx.txEffect.privateLogs;
-        txEffect.publicLogs = processedTx.txEffect.publicLogs;
-        txEffect.publicDataWrites = processedTx.txEffect.publicDataWrites;
-        txEffect.txHash = new TxHash(new Fr(blockNumber));
-        const l1ToL2Messages = Array(NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP).fill(0).map(Fr.zero);
-        await forkedWorldTrees.appendLeaves(MerkleTreeId.L1_TO_L2_MESSAGE_TREE, l1ToL2Messages);
-        const l2Block = await makeTXEBlock(forkedWorldTrees, globals, [
-            txEffect
-        ]);
-        await this.stateMachine.handleL2Block(l2Block);
-        await forkedWorldTrees.close();
-        return {
-            returnValues: executionResult.returnValues ?? [],
-            offchainEffects
-        };
     }
     async publicCallNewFlow(from, targetContractAddress, calldata, isStaticCall, gasSettings) {
-        const anchorBlockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
-        const anchoredContractData = new AnchoredContractData(this.contractStore, this.stateMachine.contractClassService, anchorBlockHeader);
-        this.logger.verbose(`Executing public function ${await anchoredContractData.getDebugFunctionName(targetContractAddress, FunctionSelector.fromField(calldata[0]))}@${targetContractAddress} isStaticCall=${isStaticCall}`);
-        const blockNumber = await this.getNextBlockNumber();
-        const txContext = new TxContext(this.chainId, this.version, gasSettings);
-        const calldataHash = await computeCalldataHash(calldata);
-        const calldataHashedValues = new HashedValues(calldata, calldataHash);
-        const globals = makeGlobalVariables();
-        globals.blockNumber = blockNumber;
-        globals.timestamp = this.nextBlockTimestamp;
-        globals.chainId = this.chainId;
-        globals.version = this.version;
-        globals.gasFees = GasFees.empty();
-        const forkedWorldTrees = await this.stateMachine.synchronizer.nativeWorldStateService.fork();
-        const bindings2 = this.logger.getBindings();
-        const contractsDB = new PublicContractsDB(new TXEPublicContractDataSource(blockNumber, this.contractStore), bindings2);
-        const guardedMerkleTrees = new GuardedMerkleTreeOperations(forkedWorldTrees);
-        const config = PublicSimulatorConfig.from({
-            skipFeeEnforcement: true,
-            collectDebugLogs: true,
-            collectHints: false,
-            collectStatistics: false,
-            collectCallMetadata: true
-        });
-        const simulator = new CppPublicTxSimulator(guardedMerkleTrees, contractsDB, globals, config, bindings2);
-        const processor = new PublicProcessor(globals, guardedMerkleTrees, contractsDB, simulator, new TestDateProvider(), undefined, createLogger('simulator:public-processor', bindings2));
-        // We're simulating a scenario in which private execution immediately enqueues a public call and halts. The private
-        // kernel init would in this case inject a nullifier with the transaction request hash as a non-revertible
-        // side-effect, which the AVM then expects to exist in order to use it as the nonce generator when siloing notes as
-        // unique.
-        const nonRevertibleAccumulatedData = PrivateToPublicAccumulatedData.empty();
-        nonRevertibleAccumulatedData.nullifiers[0] = getSingleTxBlockRequestHash(blockNumber);
-        // The enqueued public call itself we make be revertible so that the public execution is itself revertible, as tests
-        // may require producing reverts.
-        const revertibleAccumulatedData = PrivateToPublicAccumulatedData.empty();
-        revertibleAccumulatedData.publicCallRequests[0] = new PublicCallRequest(from ?? AztecAddress.NULL_MSG_SENDER, targetContractAddress, isStaticCall, calldataHash);
-        const inputsForPublic = new PartialPrivateTailPublicInputsForPublic(nonRevertibleAccumulatedData, revertibleAccumulatedData, PublicCallRequest.empty());
-        const constantData = new TxConstantData(anchorBlockHeader, txContext, Fr.zero(), Fr.zero());
-        const txData = new PrivateKernelTailCircuitPublicInputs(constantData, /*gasUsed=*/ new Gas(0, 0), /*feePayer=*/ AztecAddress.zero(), /*expirationTimestamp=*/ 0n, inputsForPublic, undefined);
-        const tx = await Tx.create({
-            data: txData,
-            chonkProof: ChonkProof.empty(),
-            contractClassLogFields: [],
-            publicFunctionCalldata: [
-                calldataHashedValues
-            ]
-        });
-        let checkpoint;
-        if (isStaticCall) {
-            checkpoint = await ForkCheckpoint.new(forkedWorldTrees);
-        }
-        const results = await processor.process([
-            tx
-        ]);
-        const [processedTx] = results[0];
-        const failedTxs = results[1];
-        if (failedTxs.length !== 0) {
-            throw new Error(`Public execution has failed: ${failedTxs[0].error}`);
-        } else if (!processedTx.revertCode.isOK()) {
-            if (processedTx.revertReason) {
-                try {
-                    await enrichPublicSimulationError(processedTx.revertReason, this.contractStore, this.stateMachine.contractClassService, anchorBlockHeader, this.logger);
-                // eslint-disable-next-line no-empty
-                } catch  {}
-                throw new Error(`Contract execution has reverted: ${processedTx.revertReason.getMessage()}`);
-            } else {
-                throw new Error('Contract execution has reverted');
+        const env = {
+            stack: [],
+            error: void 0,
+            hasError: false
+        };
+        try {
+            const anchorBlockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
+            const anchoredContractData = new AnchoredContractData(this.contractStore, this.stateMachine.contractClassService, anchorBlockHeader);
+            this.logger.verbose(`Executing public function ${await anchoredContractData.getDebugFunctionName(targetContractAddress, FunctionSelector.fromField(calldata[0]))}@${targetContractAddress} isStaticCall=${isStaticCall}`);
+            const blockNumber = await this.getNextBlockNumber();
+            const txContext = new TxContext(this.chainId, this.version, gasSettings);
+            const calldataHash = await computeCalldataHash(calldata);
+            const calldataHashedValues = new HashedValues(calldata, calldataHash);
+            const globals = makeGlobalVariables();
+            globals.blockNumber = blockNumber;
+            globals.timestamp = this.nextBlockTimestamp;
+            globals.chainId = this.chainId;
+            globals.version = this.version;
+            globals.gasFees = GasFees.empty();
+            const forkedWorldTrees = _ts_add_disposable_resource(env, await this.stateMachine.synchronizer.nativeWorldStateService.fork(), true);
+            const bindings2 = this.logger.getBindings();
+            const contractsDB = new PublicContractsDB(new TXEPublicContractDataSource(blockNumber, this.contractStore), bindings2);
+            const guardedMerkleTrees = new GuardedMerkleTreeOperations(forkedWorldTrees);
+            const config = PublicSimulatorConfig.from({
+                skipFeeEnforcement: true,
+                collectDebugLogs: true,
+                collectHints: false,
+                collectStatistics: false,
+                collectCallMetadata: true
+            });
+            // The AVM simulator reads this fork's contracts DB, scoped by fork id, for each simulation.
+            const forkId2 = forkedWorldTrees.getRevision().forkId;
+            const simulator = new PublicTxSimulator(this.stateMachine.synchronizer.avmSimulator, globals, contractsDB, forkId2, config, bindings2);
+            const processor = new PublicProcessor(globals, guardedMerkleTrees, contractsDB, simulator, new TestDateProvider(), undefined, createLogger('simulator:public-processor', bindings2));
+            // We're simulating a scenario in which private execution immediately enqueues a public call and halts. The private
+            // kernel init would in this case inject a nullifier with the transaction request hash as a non-revertible
+            // side-effect, which the AVM then expects to exist in order to use it as the nonce generator when siloing notes as
+            // unique.
+            const nonRevertibleAccumulatedData = PrivateToPublicAccumulatedData.empty();
+            nonRevertibleAccumulatedData.nullifiers[0] = getSingleTxBlockRequestHash(blockNumber);
+            // The enqueued public call itself we make be revertible so that the public execution is itself revertible, as tests
+            // may require producing reverts.
+            const revertibleAccumulatedData = PrivateToPublicAccumulatedData.empty();
+            revertibleAccumulatedData.publicCallRequests[0] = new PublicCallRequest(from ?? AztecAddress.NULL_MSG_SENDER, targetContractAddress, isStaticCall, calldataHash);
+            const inputsForPublic = new PartialPrivateTailPublicInputsForPublic(nonRevertibleAccumulatedData, revertibleAccumulatedData, PublicCallRequest.empty());
+            const constantData = new TxConstantData(anchorBlockHeader, txContext, Fr.zero(), Fr.zero());
+            const txData = new PrivateKernelTailCircuitPublicInputs(constantData, /*gasUsed=*/ new Gas(0, 0), /*feePayer=*/ AztecAddress.zero(), /*expirationTimestamp=*/ 0n, inputsForPublic, undefined);
+            const tx = await Tx.create({
+                data: txData,
+                chonkProof: ChonkProof.empty(),
+                contractClassLogFields: [],
+                publicFunctionCalldata: [
+                    calldataHashedValues
+                ]
+            });
+            let checkpoint;
+            if (isStaticCall) {
+                checkpoint = await ForkCheckpoint.new(forkedWorldTrees);
             }
-        }
-        const returnValues = results[3][0].values;
-        if (isStaticCall) {
-            await checkpoint.revert();
-            await forkedWorldTrees.close();
+            const results = await processor.process([
+                tx
+            ]);
+            const [processedTx] = results[0];
+            const failedTxs = results[1];
+            if (failedTxs.length !== 0) {
+                throw new Error(`Public execution has failed: ${failedTxs[0].error}`);
+            } else if (!processedTx.revertCode.isOK()) {
+                if (processedTx.revertReason) {
+                    try {
+                        await enrichPublicSimulationError(processedTx.revertReason, this.contractStore, this.stateMachine.contractClassService, anchorBlockHeader, this.logger);
+                    // eslint-disable-next-line no-empty
+                    } catch  {}
+                    throw new Error(`Contract execution has reverted: ${processedTx.revertReason.getMessage()}`);
+                } else {
+                    throw new Error('Contract execution has reverted');
+                }
+            }
+            const returnValues = results[3][0].values;
+            if (isStaticCall) {
+                await checkpoint.revert();
+                return returnValues ?? [];
+            }
+            const txEffect = TxEffect.empty();
+            txEffect.noteHashes = processedTx.txEffect.noteHashes;
+            txEffect.nullifiers = processedTx.txEffect.nullifiers;
+            txEffect.privateLogs = processedTx.txEffect.privateLogs;
+            txEffect.publicLogs = processedTx.txEffect.publicLogs;
+            txEffect.publicDataWrites = processedTx.txEffect.publicDataWrites;
+            txEffect.txHash = new TxHash(new Fr(blockNumber));
+            const l1ToL2Messages = Array(NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP).fill(0).map(Fr.zero);
+            await forkedWorldTrees.appendLeaves(MerkleTreeId.L1_TO_L2_MESSAGE_TREE, l1ToL2Messages);
+            const l2Block = await makeTXEBlock(forkedWorldTrees, globals, [
+                txEffect
+            ]);
+            await this.stateMachine.handleL2Block(l2Block);
             return returnValues ?? [];
+        } catch (e) {
+            env.error = e;
+            env.hasError = true;
+        } finally{
+            const result = _ts_dispose_resources(env);
+            if (result) await result;
         }
-        const txEffect = TxEffect.empty();
-        txEffect.noteHashes = processedTx.txEffect.noteHashes;
-        txEffect.nullifiers = processedTx.txEffect.nullifiers;
-        txEffect.privateLogs = processedTx.txEffect.privateLogs;
-        txEffect.publicLogs = processedTx.txEffect.publicLogs;
-        txEffect.publicDataWrites = processedTx.txEffect.publicDataWrites;
-        txEffect.txHash = new TxHash(new Fr(blockNumber));
-        const l1ToL2Messages = Array(NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP).fill(0).map(Fr.zero);
-        await forkedWorldTrees.appendLeaves(MerkleTreeId.L1_TO_L2_MESSAGE_TREE, l1ToL2Messages);
-        const l2Block = await makeTXEBlock(forkedWorldTrees, globals, [
-            txEffect
-        ]);
-        await this.stateMachine.handleL2Block(l2Block);
-        await forkedWorldTrees.close();
-        return returnValues ?? [];
     }
     async executeUtilityFunction(from, targetContractAddress, functionSelector, args, jobId, authorizedUtilityCallTargets) {
         const blockHeader = await this.stateMachine.anchorBlockStore.getBlockHeader();
@@ -621,8 +715,7 @@ export class TXEOracleTopLevelContext {
             const utilityExecutor = async (syncCall, execScopes)=>{
                 await this.executeUtilityCall(syncCall, {
                     scopes: execScopes,
-                    jobId,
-                    authorizedUtilityCallTargets
+                    jobId
                 });
             };
             const oracle = new UtilityExecutionOracle({
@@ -651,10 +744,10 @@ export class TXEOracleTopLevelContext {
                 jobId,
                 scopes,
                 simulator,
-                utilityExecutor,
                 hooks: composeHooks({
                     authorizeUtilityCall: this.buildAuthorizeUtilityCallHook('utility', authorizedUtilityCallTargets)
                 }),
+                utilityExecutor,
                 // Execution-tree root (top-level utility run or contract sync): own store; nested frames inherit it.
                 transientArrayService: new TransientArrayService()
             });
@@ -675,17 +768,21 @@ export class TXEOracleTopLevelContext {
     }
     close() {
         this.logger.debug('Exiting Top Level Context');
-        return [
-            this.nextBlockTimestamp,
-            this.authwits,
-            this.taggingSecretStrategies
-        ];
+        return {
+            nextBlockTimestamp: this.nextBlockTimestamp,
+            authwits: this.authwits,
+            taggingSecretStrategies: this.taggingSecretStrategies,
+            authorizeAllUtilityCallTargets: this.authorizeAllUtilityCallTargets
+        };
     }
     async getLastBlockNumber() {
         const block = await this.stateMachine.node.getBlock('latest');
         return block ? block.header.globalVariables.blockNumber : BlockNumber.ZERO;
     }
     buildAuthorizeUtilityCallHook(callerContext, authorizedTargets) {
+        if (this.authorizeAllUtilityCallTargets) {
+            return authorizeAllUtilityCallsHook;
+        }
         if (authorizedTargets.length === 0) {
             return undefined;
         }
@@ -694,3 +791,10 @@ export class TXEOracleTopLevelContext {
             });
     }
 }
+/**
+ * An `authorizeUtilityCall` hook that authorizes every cross-contract utility call.
+ *
+ * Backs the `aztec_txe_setAuthorizeAllUtilityCallTargets` oracle.
+ */ export const authorizeAllUtilityCallsHook = ()=>Promise.resolve({
+        authorized: true
+    });